[OpenVPN home] [Date Prev] [Date Index] [Date Next]
[OpenVPN mailing lists] [Thread Prev] [Thread Index] [Thread Next]
Web openvpn.net

[Openvpn-users] OpenVPN Routing Issue

  • Subject: [Openvpn-users] OpenVPN Routing Issue
  • From: Shamgar <shamgar331@xxxxxxxxx>
  • Date: Thu, 7 Feb 2008 10:38:07 -0600

I am trying to make use of the ccd feature to allow routing back to the client network as well.  The basic configuration works fine.  From the client side, I can ping anything on the server's LAN.  From the server side though, even on the vpn server itself, I cannot connect in any way to anything on the client side except the tunnel endpoint.  I'll note too that the server doesn't seem to be properly configuring the routes, but even doing that manually doesn't help.

The network layout is something like this:
Client LAN:
Client LAN IP:
Client VPN IP: Dynamically assigned

Server LAN:
Server LAN IP:
Server VPN IP:

When the client connects, the relevant/interesting log entries look good:
us=101380 PUSH: Received control message: 'PUSH_REPLY,route,route-gateway,topology subnet,ping 10,ping-restart 120,ifconfig'
us=101446 OPTIONS IMPORT: timers and/or timeouts modified
us=101462 OPTIONS IMPORT: --ifconfig/up options modified
us=101476 OPTIONS IMPORT: route options modified
us=101490 OPTIONS IMPORT: route-related options modified
us=101505 Preserving previous TUN/TAP instance: tun0
us=101521 Initialization Sequence Completed

On the server side though, I get this:
us=969122 [match] Peer Connection Initiated with [clientip]:48940
us=969320 match/ MULTI: Learn: -> client/[clientip]:48940
us=969441 match/ MULTI: primary virtual IP for client/[clientip]:48940:
us=16684 match/ PUSH: Received control message: 'PUSH_REQUEST'
us=16825 match/ SENT CONTROL [client]: 'PUSH_REPLY,route,route-gateway,topology subnet,ping 10,ping-restart 120,ifconfig'

Looks good right?  But I get not even a hint of trying to do the server-side configuration changes necessary to setup the routing appropriately.  In the startup debug dump I see that it is at least picking up the config data:
us=790655   route
us=795342   client_connect_script = '[UNDEF]'
us=795380   learn_address_script = '[UNDEF]'
us=795419   client_disconnect_script = '[UNDEF]'
us=795457   client_config_dir = 'ccd'
us=795495   ccd_exclusive = DISABLED

But then I get down a little further and I see this:
us=816841 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
us=816881 OpenVPN ROUTE: failed to parse/resolve route for host/network:

Is this the expected behavior for this kind of configuration?  Should it dump this error?  I used to have a config similar to this on a prior 1.x release of openvpn that worked splendidly, but for some reason I can't get it to work now.  If anyone has some hints on this I'd appreciate it.  If I add the route manually (in this case ip route add via I still can't route to the remote network.  If I start up tcpdump on the remote end and start throwing packets at it I never see anything show up there.  But return routed traffic gets through fine.  (Note: I have also completely dropped the firewalls on both ends to make sure it wasn't a firewall issue.)

(Note: I snipped generic things from the config like local/remote/ca/log/etc)
Server config:
proto tcp
dev tun
topology subnet
ifconfig-pool-persist ipp.txt
push "route"
client-config-dir ccd
keepalive 10 120
tls-auth /etc/openvpn/server/ta.key 0
max-clients 10
user nobody
group nogroup
status openvpn-status.log

server ccd/client:

Client config:
dev tun0
proto tcp
resolv-retry infinite
user nobody
group nobody
ns-cert-type server
tls-auth /etc/.openvpn/ta.key 1