0

so i have in setup, one openvpn server running on 192.168.7.0/24 subnet. the openvpn server is serving a semi comlex setup of servers, so changing the subnet is only seen as a last resort ( i hope i dont get there though)

the problem is, some users are complaining that in homeoffice, they cant use some network resources although they have the vpn on, a deeper look showed that they use for their home networks the same subnet as for the openvpn server! thus requests are being internaly routed instead of being sent via the VPN.

changing to IPv6 is not possible, and using NATing for such a thing is extrtemly dirty.

i tried force the vpn clients to use the vpn server as default GW with push "redirect-gateway def1" or/and push "redirect-gateway local def1" on the server config side, with no luck

any ideas?

many thanks

0

The problem with the gateway redirect that in the routing table the more specific entries override the less specific ones. So pushing the gateway usually not a big help, since every computer contains a /24 link-scope route entry for the local network, which is of course more specific than the advertised default route, so it will be used instead.

If you really don't want to change the VPN subnet, then the best you can do is push specific routes for the resources on the VPN network, since a route for a simple host will override the link-scope entry.

You might want to "cheat", and send two /25 networks (that is, 192.168.7.0/25 and 192.168.7.128/25), which are more specific than the local /24 network, and these two covers almost the full VPN subnet (minus the hosts on the "border" -- that is, hosts 127 and 128). In this case you want to push the redirect-local or redirect-local def1 directives as well, to make sure not to lose the default gateway, and with it, the client's connection to the VPN server.

The best solution, however, in my opinion, is to change the VPN subnet to something "ugly" which is unlikely to collide with home networks (for example, quite a few people sets their home network to something like 10.287.29.0/24). This might be a daunting task, but it is the "clean" way. Also, it is the best way to actually make sure you won't encounter surprises because of overlapping subnets.

2
  • thanks for the hint! i will work on it and keep you informed. pushing a /28 route should be enough since i have 12 hosts there – Nawras Jan 14 at 9:35
  • For 12 hosts, I don't think you even need a subnet to be advertised, you can simply push the 12 static routes. This is a cleaner solution, and 12 routes aren't that much. – Lacek Jan 14 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.