0

I have a bunch of private networks, all on the 172.XXX.XXX.XXX IP space. When I connect via OpenVPN sometimes the VPNs end up connecting through the same gateway which only allows traffic from the first VPN to work.

Example:

$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
............
172.31             10.8.0.5           UGSc            1        0   utun3
172.32             10.8.0.5           UGSc            1        0   utun3

here 172.31.XXX.XXX and 172.32.XXX.XXX are using the same gateway/interface, which only allows traffic from the first connected VPN to transfer.

OpenVPN config for server #1:

push "route 172.32.0.0 255.255.0.0"

OpenVPN config for server #2:

push "route 172.31.0.0 255.255.0.0"

Is there any way to make the two use different tunnels/gateways? Sometimes when I disconnect and connect a bunch of times they will eventually use different tunnels, but it doesn't happen every time and it's also a pain to have to connect and disconnect until things work.

The VPN configs are just the Sample configs with the extra push directive.

2

Since you mentioned that the config files are the default, except for the push lines, I'm thinking that both of them contains the default

server 10.8.0.0 255.255.255.0

line, which makes the two openvpn servers use the same pool. For this reason, when you connect to the servers, both of them will assign the first available address, which is 10.8.0.5, and instructs the client to route all connections through that. This would explain the random "now this works" moments, because if the server thinks that the address is used (e.g. you reconnect too fast), it will use the next available address in the pool, thus you get an other address assigned.

Simply change the server line to be different on the two servers, so the client will have IP address from different subnets.

This is slightly offtopic, but you may wonder why 10.8.0.5 is the first address. Openvpn assigns p2p addresses from a /30 subnet, so for every connection, a separate /30 subnet is used. The first is reserved for the server itself, so x.x.x.1 and x.x.x.2 will never gets assigned to a client. The next /30 subnet has two available address, x.x.x.5 and x.x.x.6, one of which will be assigned to the client, and the other is to the server peer address.

0

You can specify the gateway in the push route config option as follows:

--route network/IP [netmask] [gateway] [metric]
              Add route to routing table after connection is established.

So, you need to append different gateway for each network route to avoid the issue you have.

  • I've already tried this and it didn't work. push "route 162.31.0.0 255.255.0.0 utun4 1", is there something wrong with that? – David Xu Mar 22 '17 at 9:36
  • the gateway is an ip address, not an interface name. – Gerald Schneider Mar 22 '17 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.