OpenVPN / OpenVPN/openvpn

OpenVPN Removes Existing Routes on the Wrong Interface on Disconnect

Open
#455 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

macOS
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Description:
If I connect to the vpn from inside of the vpn network, then the routing table is left broken after disconnect.

To Reproduce:

  1. Look for the existing route:
$  sudo netstat -rn | grep "10.10/22"
10.10/22           link#15            UCS               en0      !
  1. connect to vpn; note that it fails to add a route for 10.10/22:
$ sudo netstat -rn | grep -e utun5 -e "10.10/22"
10.10/22           link#15            UCS               en0      !
10.10.5/24         10.10.5.5          UGSc            utun5
10.10.5.1/32       10.10.5.5          UGSc            utun5
10.10.5.5          10.10.5.6          UH              utun5
  1. disconnect from vpn; now the en0 route is completely missing
$ sudo netstat -rn | grep -e utun5 -e "10.10/22"

Note that if I connect once more, it successfully adds the route to utun5:

$ sudo netstat -rn | grep -e utun5 -e "10.10/22"
10.10/22           10.10.5.5          UGSc            utun5
10.10.5/24         10.10.5.5          UGSc            utun5
10.10.5.1/32       10.10.5.5          UGSc            utun5
10.10.5.5          10.10.5.6          UH              utun5

Expected behavior:
When disconnecting from the vpn, only remove routes that belong to the utun interface. One could argue they want the vpn route to actually go through the vpn while connected and then restore the original route when disconnected.

Work around:
Bounce wifi/network connection to reestablish proper routes through en0. (Also, don't connect to vpn from said network... but in this particular case I forgot to disconnect from the vpn while I was still away from home.)

Desktop:

  • System: Apple M2 Max
  • OS: 13.4 (22F66)
  • Tunnelblick 4.0.0beta11 (build 5910)
  • OpenVPN v2.6.6 w/SSL v3.0.12w
  • Synology Inc VPN Server v1.4.4-2855

I'm not sure how to tell what version of OpenVPN the synology server is running.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the disconnect sequence with the supplied netstat commands on macOS, comparing the en0 and utun5 routes before and after the VPN session. Done means disconnect cleanup removes only routes belonging to utun interfaces and preserves the pre-existing en0 route.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.