OpenVPN Removes Existing Routes on the Wrong Interface on Disconnect
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
Description:
If I connect to the vpn from inside of the vpn network, then the routing table is left broken after disconnect.
To Reproduce:
- Look for the existing route:
$ sudo netstat -rn | grep "10.10/22"
10.10/22 link#15 UCS en0 !
- connect to vpn; note that it fails to add a route for
10.10/22:
$ sudo netstat -rn | grep -e utun5 -e "10.10/22"
10.10/22 link#15 UCS en0 !
10.10.5/24 10.10.5.5 UGSc utun5
10.10.5.1/32 10.10.5.5 UGSc utun5
10.10.5.5 10.10.5.6 UH utun5
- disconnect from vpn; now the
en0route is completely missing
$ sudo netstat -rn | grep -e utun5 -e "10.10/22"
Note that if I connect once more, it successfully adds the route to utun5:
$ sudo netstat -rn | grep -e utun5 -e "10.10/22"
10.10/22 10.10.5.5 UGSc utun5
10.10.5/24 10.10.5.5 UGSc utun5
10.10.5.1/32 10.10.5.5 UGSc utun5
10.10.5.5 10.10.5.6 UH utun5
Expected behavior:
When disconnecting from the vpn, only remove routes that belong to the utun interface. One could argue they want the vpn route to actually go through the vpn while connected and then restore the original route when disconnected.
Work around:
Bounce wifi/network connection to reestablish proper routes through en0. (Also, don't connect to vpn from said network... but in this particular case I forgot to disconnect from the vpn while I was still away from home.)
Desktop:
- System: Apple M2 Max
- OS: 13.4 (22F66)
- Tunnelblick 4.0.0beta11 (build 5910)
- OpenVPN v2.6.6 w/SSL v3.0.12w
- Synology Inc VPN Server v1.4.4-2855
I'm not sure how to tell what version of OpenVPN the synology server is running.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the disconnect sequence with the supplied netstat commands on macOS, comparing the en0 and utun5 routes before and after the VPN session. Done means disconnect cleanup removes only routes belonging to utun interfaces and preserves the pre-existing en0 route.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100