This question was originally asked about OpenVPN not setting a default gateway if one did not already exist even if you specify
--redirect-gateway local or
--redirect-gateway def1. As of 2.4.1, OpenVPN does set a default gateway with this option whether or not one exists already, so it's obsolete if you're using that version.
Note that the version of OpenVPN in Ubuntu Zesty is 2.4.0, and doesn't have this change. But the version from Artful installs without issue on Zesty.
I have created a network namespace under Ubuntu 14.04.5, with a plan to run a VPN inside that (using OpenVPN 2.3.2 and a config file). The idea is that no traffic can be routed out of the namespace until the VPN is running.
I've implemented this by not creating a default route, and instead whitelisting the VPN server IP address. So my routing table looks like:
# ip netns exec testns ip route add A.B.C.D/32 via 10.200.200.1 dev veth1 # ip netns exec testns ip route show 10.200.200.0/24 dev veth1 proto kernel scope link src 10.200.200.2 A.B.C.D via 10.200.200.1 dev veth1
10.200.200.1 is the address of
veth0, the other end of the virtual interface
10.200.200.2). I've confirmed that my
iptables rules and IP forwarding in the root namespace works to get traffic in and out of the
testns namespace when there's a route for it.
A.B.C.D is the VPN server address.
To bring the VPN up, I run
ip netns exec testns openvpn abcd.ovpn. This config file contains a
pull directive, and the
pushed config from the server contains:
PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option[...]
But then a little later, I see:
NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
And, accordingly, there is no default route set up in my
According to the manual,
redirect-gateway def1 doesn't try to replace the default route, it just creates two new ones
220.127.116.11/1. How does not having a default route prevent these from being created? And how can I get OpenVPN to automatically route all traffic through the VPN when a default route doesn't initially exist?