2

Note

This question was originally asked about OpenVPN not setting a default gateway if one did not already exist even if you specify --redirect-gateway local or --redirect-gateway def1. As of 2.4.1, OpenVPN does set a default gateway with this option whether or not one exists already, so it's obsolete if you're using that version.

Note that the version of OpenVPN in Ubuntu Zesty is 2.4.0, and doesn't have this change. But the version from Artful installs without issue on Zesty.

I have created a network namespace under Ubuntu 14.04.5, with a plan to run a VPN inside that (using OpenVPN 2.3.2 and a config file). The idea is that no traffic can be routed out of the namespace until the VPN is running.

I've implemented this by not creating a default route, and instead whitelisting the VPN server IP address. So my routing table looks like:

# ip netns exec testns ip route add A.B.C.D/32 via 10.200.200.1 dev veth1
# ip netns exec testns ip route show
10.200.200.0/24 dev veth1  proto kernel  scope link  src 10.200.200.2 
A.B.C.D via 10.200.200.1 dev veth1

Note that 10.200.200.1 is the address of veth0, the other end of the virtual interface veth1 (10.200.200.2). I've confirmed that my iptables rules and IP forwarding in the root namespace works to get traffic in and out of the testns namespace when there's a route for it. A.B.C.D is the VPN server address.

To bring the VPN up, I run ip netns exec testns openvpn abcd.ovpn. This config file contains a pull directive, and the pushed config from the server contains:

PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option[...]

But then a little later, I see:

NOTE: unable to redirect default gateway -- Cannot read current default gateway from system

And, accordingly, there is no default route set up in my testns namespace.

According to the manual, redirect-gateway def1 doesn't try to replace the default route, it just creates two new ones 0.0.0.0/1 and 128.0.0.0/1. How does not having a default route prevent these from being created? And how can I get OpenVPN to automatically route all traffic through the VPN when a default route doesn't initially exist?

Improve this question

2 Answers 2

Reset to default
3
+50

According to the manual, redirect-gateway def1 doesn't try to replace the default route, it just creates two new ones 0.0.0.0/1 and 128.0.0.0/1. How does not having a default route prevent these from being created?

If OpenVPN were only to override the default gateway it would no longer be able to get to its peer endpoint via that original gateway. So what it does first is to look at the default gateway and set an explicit host route for its peer endpoint via that gateway.

The man page for OpenVPN is quite explicit about this:

--redirect-gateway flags...

Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN. This is a client-side option.

This option performs three steps:

(1) Create a static route for the --remote address which forwards to the pre-existing default gateway. This is done so that (3) will not create a routing loop.

(2) Delete the default gateway route.

(3) Set the new default gateway to be the VPN endpoint address (derived either from --route-gateway or the second parameter to --ifconfig when --dev tun is specified).

When the tunnel is torn down, all of the above steps are reversed so that the original default route is restored.

You then ask

how can I get OpenVPN to automatically route all traffic through the VPN when a default route doesn't initially exist?

A route must exist (somewhere) for the OpenVPN client to get to its peer endpoint (i.e. the server). So whatever that route is, you will need to implement the three tasks described above in a --up script. You'll need to write this script, of course.

Improve this answer
5
  • A route must exist (somewhere) for the OpenVPN client to get to its peer endpoint (i.e. the server). - Yep, I set a single route that points to the server ip route add A.B.C.D/32 via 10.200.200.1 dev veth1, as a kind of off-by-default kill switch.
    – detly
    Commented Sep 17, 2016 at 21:32
  • @detly n that case all you should need is step (3) then.
    – Chris Davies
    Commented Sep 17, 2016 at 22:25
  • Makes sense. I guess what I was asking was whether there's a way to tell OpenVPN to do this automatically rather than having to write a script myself. But if there's not, there's not, I'll write a script. I think OpenVPN exports some useful env vars for this purpose too.
    – detly
    Commented Sep 18, 2016 at 3:20
  • 1
    The script should only be one or two lines - basically a pair of route add lines in the manner of the ones that OpenVPN would add
    – Chris Davies
    Commented Sep 18, 2016 at 7:22
  • For the record, my script is basically ip route add default via $5 dev $1. $5 is the ifconfig_remote_ip arg and $1 is the tun_dev arg.
    – detly
    Commented Oct 4, 2016 at 11:41
1

Two work around options:

  • Set a fake default gateway (eg 127.0.0.1) and allow OpenVPN to overwrite it.
  • Use a post run script to set the gateway using ip route
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .