LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-19-2017, 05:59 PM   #1
n1uro
Member
 
Registered: Feb 2016
Posts: 32

Rep: Reputation: Disabled
OpenVPN and policy routing


Thanks for reading this. I'm trying to figure out how I could push routing from an OpenVPN host to an OpenVPN client using policy routing using ip rules and such.

Typically we just use ip protocol 4 (ipencap) but it appears the ISP now is filtering this. The encryption part of the VPN isn't really required and the IPs are public for the amateur packet radio network (ampr.org) which faces the global internet at UCSD.EDU. In short this would be used to bypass Source Address filtering where ipencap is being filtered.

I can get the IPs and routing passed *only* for 44/8 connectivity but global routing fails. I believe if I can push the following rules this may work:
n1uro@n1uro:~$ ip ru
0: from all lookup local
1: from 44.0.0.0/8 lookup 1
1: from all to 44.0.0.0/8 lookup 1
32766: from all lookup main
32767: from all lookup default
but so far I've been unsuccessful with the push.
Also with this policy I'd need to set a default route back to the server
if the client sources it's outbound with a 44-net IP. This works perfect using ipencap (pending no ISP blocks).

Suggestions are welcome.
 
Old 04-20-2017, 09:34 AM   #2
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,574
Blog Entries: 4

Rep: Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890
Quote:
Originally Posted by n1uro View Post
but so far I've been unsuccessful with the push.
I don't really know what you mean by this. The server uses "push," and the client uses "pull?" Show us your config files.
 
Old 04-20-2017, 09:47 AM   #3
n1uro
Member
 
Registered: Feb 2016
Posts: 32

Original Poster
Rep: Reputation: Disabled
I need the server to push a specific statements to the client including
"ip rule add from x.x.x.x"
and "ip route add x.x.x.x via y.y.y.y dev tun0 table 44"
for example. It seems the only thing I can do is push a route to the main table.

ifconfig-push 44.88.0.203 44.88.0.1
push "route 44.88.0.0 255.255.255.0"
works but only for within 44/8. I need something that can define a policy
to the client so that when the tun0 interface comes up, even 0.0.0.0/0 will route IF
the client sources itself as 44.88.0.203. I can't pre-define this if the tun0 interface
is not up and active.
 
Old 04-24-2017, 11:35 AM   #4
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,574
Blog Entries: 4

Rep: Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890Reputation: 3890
I suspect that you have passed beyond the design-intent of push in this case.

You are, after all, communicating a request to the OpenVPN client, to cause it to recognize the route and to issue the corresponding operating-system route commands in order to cause traffic to be sent to the tunnel. This isn't a generalized case on the order of, say, an ifup clause in /etc/network/interfaces. You aren't asking the client to "send an arbitrary command to the host," and I don't know of any way to do such a thing. I think that it's "out-of-scope for OpenVPN's purposes."

Last edited by sundialsvcs; 04-24-2017 at 11:38 AM.
 
Old 04-24-2017, 12:01 PM   #5
n1uro
Member
 
Registered: Feb 2016
Posts: 32

Original Poster
Rep: Reputation: Disabled
Actually, I was sort of hoping the `push "statement"` could act as a way to execute a script of sorts. That would engage the policy
routing I'd need it to do once the tun device is configured... and you have it backwards. The server would tell the client "I see you now, so you are to engage policy routing". The client wouldn't send a command to the server at all.
 
Old 04-24-2017, 11:36 PM   #6
lsalab
LQ Newbie
 
Registered: Jan 2009
Posts: 24

Rep: Reputation: 3
Have you tried the 'redirect-gateway' directive in the config file of your clients???

This directive will instruct the clients to use your VPN connection as the default gateway, therefore they will use any policy routing that you configure in your server.
 
1 members found this post helpful.
Old 04-26-2017, 01:35 PM   #7
n1uro
Member
 
Registered: Feb 2016
Posts: 32

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by lsalab View Post
Have you tried the 'redirect-gateway' directive in the config file of your clients???

This directive will instruct the clients to use your VPN connection as the default gateway, therefore they will use any policy routing that you configure in your server.
Thanks for the reply, this isn't what I wish to do either... I really don't think there's a solution to what I'm looking for.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Mutiple IPs and network cards routing (source policy routing?) shogun1234 Linux - Networking 1 01-17-2013 01:09 AM
Error When converting Routing OpenVPN to bridge mode openvpn danmartinj Linux - Software 0 11-06-2009 10:23 AM
policy routing for HTTP traffic over OpenVPN mikeage Linux - Networking 1 05-21-2009 08:13 AM
policy routing mail2mphani Linux - Newbie 1 04-16-2009 01:48 AM
[help] RH Network Routing Policy princenux Linux - Networking 1 07-04-2004 11:34 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration