Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

if openvpn is running, normal internet connections don't work.

My wlan-router is 192.168.178.1

root@e520:~# ip route show
default via 192.168.178.1 dev eth0  proto static 
10.0.0.0/8 via 192.168.156.1 dev tap0 
128.0.0.0/1 via 192.168.156.1 dev tap0 
169.254.0.0/16 dev wlan0  scope link  metric 1000 
172.17.6.0/24 via 192.168.156.1 dev tap0 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1 
192.168.156.0/24 dev tap0  proto kernel  scope link  src 192.168.156.15 
192.168.178.0/24 dev eth0  proto kernel  scope link  src 192.168.178.21  metric 1 
192.168.178.0/24 dev wlan0  proto kernel  scope link  src 192.168.178.25  metric 2 
194.113.71.71 via 192.168.178.1 dev wlan0 

If I try to do a non-openvpn connection the wrong route gets chosen:

root@e520:~# tcptraceroute web.de http
Selected device tap0, address 192.168.156.15, port 41576 for outgoing packets
Tracing the path to web.de (217.72.200.132) on TCP port 80 (www), 30 hops max
 1 ... hanging

Why does 192.168.156.15 get used to access this IP address?

share|improve this question

1 Answer 1

up vote 1 down vote accepted
web.de has address 217.72.200.132

The longest prefix match in your routing table is:

128.0.0.0/1 via 192.168.156.1 dev tap0

Which tells the kernel to route the packet via the VPN. You have the redirect-gateway option set (either in the client configuration, or pushed by the server). This causes OpenVPN to add routes so that all traffic is routed via the VPN (although I'm not sure why you have 128/1 and not 0/1 as well). Remove the redirect-gateway configuration directive and your routing should work normally.

share|improve this answer
    
The routing is done by the linux, and I posted my routing table. If I start tcptraceroute it says "Selected device tap0, address 192.168.156.15". At this level OpenVPN does not interfere. Why does the device tap get chosen? Why does the default-gw not get used? –  guettli Apr 25 '12 at 20:32
    
Your routing table is telling the kernel to route the packet via OpenVPN (clarified in answer). –  mgorven Apr 25 '12 at 20:40
    
Thank you for the clarified answer! BTW "longest prefix match" is explained here: en.wikipedia.org/wiki/Longest_prefix_match –  guettli Apr 26 '12 at 7:17
    
Yes, after ip route del 128.0.0.0/1 via 192.168.156.1 dev tap0 it worked. Now I check the redirect-gateway option. –  guettli May 22 '12 at 19:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.