1

I am trying to configure OpenVPN for access to a remote network (192.168.1.0/24) which is the same as my local network. Because of this I have added the following to the server config to force traffic through the VPN:

push "route 192.168.1.0 255.255.255.0"

Unfortunately I see the following when connecting:

route: writing to routing socket: File exists
add net 192.168.1.0: gateway 10.200.0.5: File exists

due to an existing route, presumably due to static DHCP routes:

$ netstat -nr -f inet
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
...
192.168.1          link#6             UCS             4        0     en0      !
...

If I connect and disconnect from OpenVPN this existing route is cleared so when I reconnect everything works. How can I configure OpenVPN so that this route is configured properly on first connect? I do not want to rely on a local DHCP configuration so I need to either need to clear the problematic route or replace it when connecting.

Note: I also tried setting push "redirect-gateway def1" in the server config, but again due to this existing route traffic for 192.168.1.0/24 is not routed through the VPN.

  • uname -a: Darwin Lukes-Work-MBP 18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64
  • OpenVPN version: 2.3.14
  • 1
    You have 192.168.1.0/24 remote and local network, correct? And if you reconnect OpenVPN, the local route is deleted and the VPN route is added? How can you communicate with your local subnet, then? Usually it's a no-go to use the same subnet for OpenVPN connections (or you need some special form of NAT) OR you can't access devices on your local subnet, pick your poison :) – Lenniey Jul 12 at 12:37
  • correct - it's actually the disconnect that is deleting the local route because the route config is reversed (even though it failed to apply initially). When I'm connected to the VPN I don't want to connect to my local subnet, I want all traffic to go via the VPN. One solution is to add /sbin/route -n delete 192.168.1.0/24 to a local script, but then the local route doesn't come back (not an issue in this case but I would like this solution to be more general) – dippynark Jul 12 at 12:58
  • Try setting--redirect-gateway using the local, autolocal and/ or block-local flags – Lenniey Jul 12 at 13:12
  • block-local is the one! Post as an answer and I will accept @Lenniey – dippynark Jul 12 at 13:23
2

Solved using redirect-gateway with the block-local flag, essentially blocking all connections to the local network and routing all traffic through the VPN server to the remote network.

  • Note I no longer need to have push "route 192.168.1.0 255.255.255.0" on the server config, I just have push "redirect-gateway def1" on the server and redirect-gateway def1 block-local on the client – dippynark Jul 12 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.