On Thu, 1 Dec 2005, Jon Bendtsen wrote:
However, if i ping a unused IP address i get this:
tcpdump: 16:00:39.564517 IP 192.168.123.34 > 192.168.123.36: icmp 92:
redirect 192.168.123.39 to host 192.168.123.39
PING 192.168.123.39 (192.168.123.39): 56 data bytes
92 bytes from 192.168.123.34: Redirect Host(New addr: 192.168.123.39)
When you, the OpenVPN client sends a ping to an unused IP in the subnet
assigned to your tun interface, this will, according to your route, be
sent out on your tun interface.
This will be recieved by the OpenVPN server which sees a ping packet with
a dest IP that is unknown for OpenVPN. So what happends then? It´s no
ethernet interface so we can´t broadcast any arp request. So, as I see it
we can do 3 things.
1) Drop the packet.
2) Send it down to the kernel on the server via the tun interface.
3) Broadcast the packet to all clients (including the server itself).
...
One thought I have is, what if we do 1 instead, we drop packets destinated
for unknown IPs (for --dev tun, --topology subnet mode). It is a tun
interface so it´s not supposed to be bridged with any other networks, so
OpenVPN should know about all IP addresses that are in use already, right?