Openvpn and routing

Hi,

I have a problem with more than one n2n OpenVPN tunnel.
I searched a long time why I can’t reach the network over the second OpenVPN tunnel although IPFire shows it up for a long time and after this it is in reconnecting state :frowning:

My first tunnel has the following parameters:


remote network: 172.30.0.0/255.255.248.0
transfer network: 172.16.0.0/255.255.255.252

The second has the following parameter:


remote network: 172.30.8.0/255.255.248.0
transfer network: 172.16.0.4/255.255.255.252

Both OpenVPN tunnel seems to be online:

If I take a look at the routing table I found the following:
grafik
172.16.0.2 dev tun1 proto kernel scope link src 172.16.0.1
172.16.0.2 dev tun2 proto kernel scope link src 172.16.0.1
172.30.0.0/21 via 172.16.0.2 dev tun1
172.30.8.0/21 via 172.16.0.2 dev tun1

What happened? I don’t understand why IPFire defines the device tun2 on this way and routes all traffic for the second OpenVPN tunnel over tun1.
I deleted both tunnel more then one time but there was every time the same effect. The logs show the related commands. The text configuration files seems to be the same, no change which explain this. For the second OpenVPN tunnel there are no firewall rules, only for the first one (Policy: Allowed). The OpenVPN client network is 172.31.0.0/24.
It happens with all IPFire versions including 138.

How how how… Bug you are my friend…
I found if I change the transfer network for the second OpenVPN tunnel to 172.16.1.0/255.255.255.252 or similar it works!
It seem to be a subnet mask problem. Is 255.255.255.0 anywhere hardcoded?

I files bug report id 12262.

Regards

Stefan

Hi Stefan,
indeed the subnetmask of the transfernet is hardcoded to /255.255.255.0 --> https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=html/cgi-bin/ovpnmain.cgi;h=e76a688fe7dcda0b77bf716eb2538342cd775b00;hb=HEAD#l3443 .

Best,

Erik

1 Like

That’s bad…