0

I have a openvpn works perfect in the windows7, but in my ubuntu OpenVPN 2.3.7, it is very strange. I can make the openvpn login, and connect to my vpn network, browse the internet. But after some minutes, all connections stop, even the local default gateway(192.168.1.1) which is my router lost.

#> ip route show  # this is after openvpn connected
default via 10.89.0.153 dev tun0  proto static  metric 50 
default via 192.168.1.1 dev wlan0  proto static  metric 600 
10.10.1.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
10.16.128.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
10.16.129.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
10.82.1.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
10.89.0.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
10.89.0.153 dev tun0  proto kernel  scope link  src 10.89.0.154 
10.89.0.153 dev tun0  proto static  scope link  metric 950 
10.89.0.154 dev tun0  proto kernel  scope link  src 10.89.0.154  metric 50 
172.16.50.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
172.16.128.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.42.1 
172.17.0.0/16 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.1.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.110  metric 600 
192.168.2.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.3.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.69.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.89.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.99.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.102.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.109.0/24 via 10.89.0.153 dev tun0  proto static  metric 50 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1 
221.123.111.254 via 192.168.1.1 dev wlan0  proto static  metric 600

When I ping my default gateway (my router), you can see that, suddenly the time is soaring up, it happened some minutes after the openvpn connected.

64 bytes from 192.168.1.1: icmp_seq=154 ttl=253 time=28.6 ms
64 bytes from 192.168.1.1: icmp_seq=155 ttl=253 time=27.8 ms
64 bytes from 192.168.1.1: icmp_seq=156 ttl=253 time=30.6 ms
64 bytes from 192.168.1.1: icmp_seq=157 ttl=253 time=29.3 ms
64 bytes from 192.168.1.1: icmp_seq=158 ttl=253 time=28.8 ms
64 bytes from 192.168.1.1: icmp_seq=161 ttl=253 time=30.1 ms
64 bytes from 192.168.1.1: icmp_seq=164 ttl=253 time=71935 ms
64 bytes from 192.168.1.1: icmp_seq=165 ttl=253 time=70965 ms
64 bytes from 192.168.1.1: icmp_seq=166 ttl=253 time=69985 ms
64 bytes from 192.168.1.1: icmp_seq=167 ttl=253 time=68977 ms
64 bytes from 192.168.1.1: icmp_seq=168 ttl=253 time=67969 ms
64 bytes from 192.168.1.1: icmp_seq=169 ttl=253 time=66961 ms
64 bytes from 192.168.1.1: icmp_seq=170 ttl=253 time=65984 ms

My openvpn setting file: cat client.ovpn

client
remote 221.123.111.254
proto tcp
dev tun
ca ca.crt
comp-lzo
persist-key
persist-tun
verb 3
route-delay 2
route-method exe

And I got this after openvpn connection established:

~$ ip r get 192.168.1.1
192.168.1.1 via 10.89.0.153 dev tun0  src 10.89.0.154 
    cache 
  • What does ip r get 192.168.1.1 show after openvpn launched? – user140866 Nov 28 '15 at 9:37
  • @siblynx ip r get 192.168.1.1 shows this: 192.168.1.1 via 10.89.0.153 dev tun0 src 10.89.0.154 cache – Liao Zhuodi Nov 28 '15 at 13:40
1

You overwrite the one possible path to your real gateway:

default via 10.89.0.153 dev tun0 proto static metric 50

which has higher priority than your real default route, and

192.168.1.0/24 via 10.89.0.153 dev tun0 proto static metric 50

which is useless and possibly harmful for your setup.

Both these routes redefine 192.168.1.1 to go through tun0 which is not possible since openvpn wants to exchange real traffic with physical 192.168.1.1 but not with virtual one (if exists).

However removing 192.168.1.0/24 tun0 will not solve your issue, and you should be adding an explicit route which will redefine 192.168.1.1 again to go through your real interface:

ip r add 192.168.1.1/32 dev wlan0

Remember that once you (or any VPN program) redefines default route to let you go through VPN to Internet, then you need to tell the kernel where it can find real gateway again to pass traffic through.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.