How To Properly Use route and iroute?

databits

Hello, this is my server config:

local
port 139
proto udp
dev tun
topology subnet
tun-mtu 1500
mssfix 1450
ca /etc/openvpn/xx/xx.crt
cert /etc/openvpn/xx/server.crt
key /etc/openvpn/xx/server.key
dh /etc/openvpn/xx/dh1024.pem

script-security 2
tmp-dir /etc/openvpn/tmp
auth-user-pass-verify /etc/openvpn/auth.sh via-file
username-as-common-name

client-cert-not-required
server 10.8.0.0 255.255.255.0
route 10.8.0.0 255.255.255.0 10.8.0.1
iroute 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"
#duplicate-cn
comp-lzo
persist-key
persist-tun
status vpn.log 5
verb 2
float
max-clients 25

When I try to run OpenVPN, I got something like "iroute cannot be use in this context" error.
What should I do to fix this problem? Should I also use --route-gateway?
Should I also add something in the client config?

I don't really get the explaination in Manuals page. 😃

Mimiko

"iroute" option is used in separate ccd-file for the clients with the name exactly as the common name given to the clients when generating certificates for them. "iroute" indicates to OpenVPN interna routing table where to route packets for client's LAN, which routing table is not the systems routing table.

databits

Ok, thanks for the response but I only have 1 certificate for all of my clients. How could I do that?

janjust

what do you wish to achieve? subnet to subnet routing? I'd really recommend to use multiple client certs, otherwise you'll have to resort to username+password authentication.