OpenVPN / OpenVPN/openvpn

Internal routing precedence of broad iroute overshadowing a server’s own local subnet within OpenVPN’s internal routing algorithm

Open
#956 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement non-trivial change
Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

In a situation where there is

  • a local network, e.g. 172.16.11.0/24 attached to the server system and
  • broader network, e.g. 172.16.0.0/12 shall be routed to a specific OpenVPN client, so
  • route 172.16.0.0 255.240.0.0 is specified in the server config and corresponding iroute 172.16.0.0 255.240.0.0 in the client's CCD file,
    the OpenVPN internal routing violates the longer-prefix rule and routes packets for 172.16.11.0/24 to the specific client instead of to the local server system.

To Reproduce
Add a broader route to the server config that corresponds to a local network behind the server, that routes the packets (back) to a client and then try to reach the local network behind the server from the client.

Expected behavior
Longer-prefix rule is observed, local network behind the server is reachable.

Version information (please complete the following information):

  • OS: Debian 12.11
  • OpenVPN version: 2.6.3

A warning that an internal OpenVPN route overlaps a local route would be helpful.
A server-side "iroute" which would add a local route to the OpenVPN Server's internal route without adding it to the kernel routing table would fix this as well, but AFAICU it would be good and better if OpenVPN internal routing would respect the longer-prefix rule.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the described server and client configuration on OpenVPN 2.6.3 with a local 172.16.11.0/24 network and broader 172.16.0.0/12 iroute. Trace the internal routing selection to determine why the broader route wins, then verify that the longer-prefix local route is selected and consider the requested overlap warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.