0

I've a running server of openVPN. This server is configured to only route traffic to internal network when needed. In server.conf:

...
push "route 192.168.0.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.0.xxx"
;duplicate-cn
...

All devices (win, mac, ios and android) working with official openvpn connect client work as expected: they reach internal network but rest of navigation goes directly to internet. However, when I use network-mananger in ubuntu 22.04 importing the ovpn profile the client connects properly, the dns works... but ALL the traffic is routed through the vpn.

If I use openvpn command I'm able to connect to ovpn as expected (routing traffic properly) but is not comfortable tu run sudo commands( "sudo openvpn --script-security 2 --config /etc/openvpn/client/profile.ovpn") and do some weird stuff.

This is the significant part of my ovpn client profile:

client
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-GCM
auth SHA512
verb 3
tls-client
tls-version-min 1.2
key-direction 1
remote-cert-tls server
remote mydomain.com 1194
<ca>

Edit: I've found a difference. Ubuntu network manager is generanting a third device.

So, with the "openvpn --script-security 2 --config /etc/openvpn/client.ovpn" script I get these two devices: tun0: 10.8.0.14 enxzzzz: 192.168.18.6

with ubuntu network manager they are the same but there's a third device! virbr0: 192.168.122.1

5
  • What is the ip of your ubuntu client ?
    – Marco
    Oct 27, 2023 at 11:37
  • @marco with the "openvpn --script-security 2 --config /etc/openvpn/client.ovpn" script are: tun0: 10.8.0.14 enxzzzz: 192.168.18.6 with ubuntu network manager they are the same but there's a third device! virbr0: 192.168.122.1 Oct 31, 2023 at 16:53
  • it would be interesting to see the output of ip route before and during the openvpn connection.
    – Marco
    Nov 1, 2023 at 9:29
  • Here you have the three different configurations https://controlc.com/c548b250 Nov 2, 2023 at 15:11
  • As this is no forum and comments are for asking clarification of the question, you better add the output to the question.
    – Marco
    Nov 3, 2023 at 13:29

1 Answer 1

2

The "push" settings of the OpenVPN server can be overwritten by the client. Never expect the client is using them.

Seems Network Manager by default does not set "Use this connection only for resources on this network". Which disables or enables the default route through the VPN connection.

The openvpn command respects the "push" from server and works as expected.

The command line to change this:

nmicli connection modify "YourVPNConnection" ipv4.never-default yes

accordingly with ipv6 if needed.

Or in the Gui:
Gnome Network Manager IPv4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .