Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When having an OpenVPN instance working fine I'm having troubles with networks conflict in some specific circumstances. The setup is as this:

tun-mode
clients' network in OpenVPN: 172.16.159/24
network behind the OpenVPN server: 10.0.1/24 (route-pushed to clients)

Now, having a client's local network with default gateway laying in the 10.0.1/24 client gets out of Internet as soon as routes are pushed to client's connection and applied on it because of, say 10.0.1.3 as default gateway, is routed to more-specific 10.0.1/24 pushed from server which in turn is routed through tun0 p-t-p device which in turn relies on OpenVPN connection that needs a functional default gateway to be kept alive. Is there a way in OpenVPN to preserve default gateway to the network device it is found on before pushed routes are applied so more-specific /32 route gives a correct routing to default gateway instead of tunneled route? I try to avoid having bash and cmd scripts for resolving this and just stay with a config full of dexterity.

Changing networks on either side is not appliable. Say, a person needs to do some work on internal resources while in business travel. No one can predict and guarantee that person's local network (for example hotel's network) does interfere with no tunneled networks.

Update:

10.0.1.17/16 -> 10.0.1.1 -> 1.2.3.4 -> 10.0.1.0/24
    client      client's    openvpn    tunneled private
   notebook      router      server     network

I want a simple config trick (if any exists) that pushes something like

route add 10.0.1.1 mask 255.255.255.255 10.0.1.17

if we speak of Windows syntax before server pushed routes are applied. 10.0.1.1 unreachable on the tunneled network is clear and understandable.

share|improve this question
    
I never found a sane way to handle such overlaps with OpenVPN. They simply should not happen IMO. –  the-wabbit Apr 19 '13 at 8:02
    
But they will and even should happen by design in case of a person whose connection is not predefined (like that businessman in a random hotel) –  GateKeeper Apr 19 '13 at 11:38
1  
This is a shortcoming of NATting and over-provisioning IPv4 address space. Addresses have to be unique by definition, it is a major hassle if you have to work around this limitation. What you could do is provide two VPN gateways with different address spaces, so the user could choose "the other one" in case of address space collisions. –  the-wabbit Apr 19 '13 at 12:26
    
I updated my question to make it more clear. –  GateKeeper Apr 19 '13 at 12:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.