OpenVPN / OpenVPN/openvpn

iroute sometimes gets lost using dco-module

Open
#438 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug DCO linux
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
I have a server and a client previously running debian buster. The client is running in daemon mode and is always connected. i had a stable connection for years.
The clients network (192.168.89.0/24) is routed to the server by
a) giving it a fixed ip-adress within the vpn-subnet
b) and setting an iroute
in the client-file within the ccd-dir.

additionally the route-property (192.168.89.0/24) is set in the server.conf.

After upgrading both of them (didn't check what happens if only the server was upgraded) to bookworm using openvpn 2.6.3 and enabling the dco-module, behaviour changed as excepted:
since the dco-module is using kernel-routes (instead of the old internal routing-mechanism) i now have one route on the serverside, that is always set, if the server-daemon is running (resulting from the route-property):

192.168.89.0/24 via 192.168.23.2 dev tun0 metric 200

and one route, that is automatically beeing added if the client is connected:

192.168.89.0/24 via 192.168.23.253 dev tun0 metric 100

So far so god...

But: There is a strange behavior that seems to occur, if the client changes its public ip-address, for example through dhcp by the provider (i think, it has to do with that, but i'm not sure).

The route added by the dco-module (because of the iroute-command in client ccd) is getting lost.

ip route show

then doesn't list it anymore. The 192.168.89.0/24-network is then not reachable anymore.
But the vpn-channel seems to be alive since i can access the client through its static vpn-subnet-ip (192.168.23.253).

To Reproduce

  • Setup a server using dco-module
  • configure a client to route its subnet using iroute in ccd
  • let a client connect and keep the connection alive until it's ip-address changes
  • check kernel-routing-table on server-side

Expected behavior
The route created by the dco-module should not get lost

Version information (please complete the following information):
Server:

  • OS: debian bookworm
  • OpenVPN version: 2.6.3
  • DCO: 0.0+git20230324-1

Client:

  • OS: debian bookworm
  • OpenVPN version: 2.6.3
  • DCO: 0.0+git20230324-1

Additional context
I have an other client still running buster and therefore without dco enabled. this doesn't cause any problems. but it doesn't change its ip-adress. I dont know if it is related to that or if it makes a difference, when the client is using the dco-module. this just as a hint to you...

thanks for your effort and greetz,
Karsten

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the setup described with OpenVPN 2.6.3 and the DCO module: a client CCD iroute, a changing client public IP, and the server's kernel routing table. Start with ip route show on the server before and after the address change; done means the route for 192.168.89.0/24 remains present and the client subnet stays reachable.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, debian, linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.