OpenVPN / OpenVPN/openvpn

net_gateway works, but net_gateway_ipv6 is wrong

Open
#1,015 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

I'm running an OpenVPN client from my home broadband. I need to forward DNS resolution to my home broadband provider, however they only allow their own client networks to query their DNS resolvers. Therefore, I need to ensure that this traffic doesn't go through the OpenVPN tunnel but stays on the broadband.

Easy enough to configure:

route dns3.telefonica.de 255.255.255.255 net_gateway
route-ipv6 dns3.telefonica.de/128 net_gateway_ipv6

Given

# host dns3.telefonica.de
dns3.telefonica.de has address 62.109.121.1
dns3.telefonica.de has IPv6 address 2a01:c30::530

the result is wrong however:

# netstat -rn | egrep '62.109.121.1|2a01:c30::530|Dest'
Destination        Gateway            Flags         Netif Expire
62.109.121.1       192.168.178.1      UGHS            re0
Destination                       Gateway                       Flags         Netif Expire
2a01:c30::530                     link#4                        UHS            tun0

Clearly visible that the IPv4 case is correct (and I have verified it works) but the IPv6 case points to the tunnel (tun0) instead of the broadband (re0) interface.

There's been some discussion around this years ago. However the patch provided (applies to OpenVPN 2.6) had not been committed apparently, and is also not committed to 2.7. I have modified this patch slightly so that it applies cleanly to 2.7.1, see patch.patch. With the patch applied, the result is correct:

# netstat -rn | egrep '62.109.121.1|2a01:c30::530|Dest'
Destination        Gateway            Flags         Netif Expire
62.109.121.1       192.168.178.1      UGHS            re0
Destination                       Gateway                       Flags         Netif Expire
2a01:c30::530                     fe80::5e49:79ff:fecc:ecf3%re0 UGHS            re0

OS: FreeBSD 15.0-STABLE
OpenVPN version: 2.7.1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the linked historical patch and the attached patch.patch, then reproduce the route-ipv6 net_gateway_ipv6 behavior on FreeBSD 15.0-STABLE with the configuration shown. Done means the IPv6 route for 2a01:c30::530 uses the broadband interface re0 rather than the OpenVPN tunnel tun0.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.