1

I am testing the creation of an enforced default route of only public IPv4 space via OpenVPN. OpenVPN does not support

'iroute  0.0.0.0  0.0.0.0'
out of the box, because it contains code that rejects it. But if you remove that code and get iroute 0.0.0.0 to work, logically the connection times out after a while because OpenVPN gets confused.

I found out that the minimal range to iroute is a /4. So if you want to divide all IPv4 space into /4 blocks, you end up with 16 blocks ranging from 0.0.0.0 to 255.255.255.255. But this contains all routable and unroutable IPs... so the list needs to be further delimited.

Because of a non-generic setup I cannot use redirect-gateway stuff. That's why I I am looking for a list of subnets, that is as short as possible, of the public IP ranges that exist. The list has to exclude ranges that are reserved (and my own server's public IP/32). Basically, I'd like to have a list of the opposite of RFC 5735 (page 6)

Does such a list exist and/or how can one be generated?

  • I should add two things. 1) I am using Linux. 2) OpenVPN has an internal routing table. So simply adding the routes into Linux' routing tables is not enough. Believe me, I tried. – drumfire Sep 10 '11 at 11:00
  • Add that to your question with an edit, don't use a comment. – womble Sep 10 '11 at 11:00
1

Why are you using iroute? I just have 'push "route 0.0.0.0 0.0.0.0"' in my OpenVPN server config and it works great (well, I need to knobble the default route that comes out of DHCP, but that's trivial).

| improve this answer | |
  • Yes, I understand your question. I am using this because the setup actually goes via two openvpn connections: one of the clients of the OpenVPN server must route these. That is why I have to use iroute. In your case, you could also choose to use 'push "redirect-gateway"' and, for clients you want to except from this, use 'push-reset' – drumfire Sep 10 '11 at 11:04
  • When I started using OpenVPN, redirect-gateway well and truly didn't exist. Perhaps you might want to consider my answer to this rather similar question. Not that having a route for unrouteable addresses should cause any problems, because they shouldn't get further than the first firewall they meet anyway. – womble Sep 10 '11 at 11:13
  • Ha, yes. The answers also contain a link to cidr-report.org/bogons/allocspace-prefix.txt and this seems to be exactly what I need. (I wonder if it can be made more compact.) Thank you! – drumfire Sep 10 '11 at 11:20
  • Well, netmask takes multiple ranges and condenses them, but the list is patchy enough that there's not a lot of aggregation that is effective. – womble Sep 10 '11 at 11:27
1

Update, I decided to write a program to solve the problem of inverting a list of cidr blocks. You can get it from. https://github.com/plugwash/cidrinverse

Running the program on the list of blocks from rfc 5735 gives a list of 111 cidr blocks. I won't paste the full list here but you can easilly re-run the program yourself if you wish.


note: there have been some additional special registrations since that document was released, also some "special" ranges are used on the public internet, for example 192.88.99.0/24)

but anyway lets say we want to find a list of cidr masks for all space that rfc 5735 does not consider special.

The list in rfc 5735 is already sorted so we can easilly work through the list and write down the ranges of IPs in between.

  • 1.0.0.0 to 9.255.255.255
  • 11.0.0.0 to 126.255.255.255
  • 128.0.0.0 to 169.253.255.255
  • 169.255.0.0 to 172.15.255.255
  • 172.32.0.0 to 191.255.255.255
  • 192.0.1.0 to 192.0.1.255
  • 192.0.3.0 to 192.88.98.255
  • 192.88.100.0 to 192.167.255.255
  • 192.169.0.0 to 198.17.255.255
  • 198.20.0.0 to 198.51.99.255
  • 198.51.101.0 to 203.0.112.255
  • 203.0.113.0 to 223.255.255.255

We can translate each of these ranges to a list of CIDR masks by using the "netmask" command line tool as suggested at CIDR Ranges for Everything except RFC1918

netmask -c 1.0.0.0:9.255.255.255

I haven't proccessed the full list but from trying a couple of the ranges I guess it will have somewhere around 60 entries.

| improve this answer | |
0

That problem in bug:

https://community.openvpn.net/openvpn/ticket/726

And for temporary solve i use that ccd content: https://community.openvpn.net/openvpn/attachment/ticket/726/ccd_tmp_fixed_content

| improve this answer | |
  • Welcome to Server Fault! Whilst this may theoretically answer the question, please provide context around links so others will have some idea what it is and why it’s there. If possible summarise or quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. – HBruijn Aug 24 '16 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.