Hi all, since OpenVPN 2.7.0 was released last week, I’ve done some more testing with the new DCO flag.
``` @@ -73,10 +73,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/var/ipfire/ovpn \ - --enable-iproute2 \ --enable-plugins \ --enable-plugin-auth-pam \ - --enable-plugin-down-root + --enable-plugin-down-root \ + --enable-dco ``` I’ve found a couple of other issues: There have been some changes in the management interface, and a protocol prefix is now included (e.g. udp4:). As a result, the old regex patterns for a) OpenVPN Connection Statistics and b) Connection Status no longer update or show data. This shouldn’t be hard to fix. With OpenVPN 2.7.0, a MULTI ERROR appears when creating a client with “redirect-gateway”. Example message: ``` Feb 19 13:34:36 ipfire-prime openvpnserver[7329]: PeterForden/udp4:192.168.110.10:38103 MULTI ERROR: primary virtual IP for PeterForden/udp4:192.168.110.10:38103 (10.12.52.2) violates tunnel network/netmask constraint (10.73.104.0/255.255.255.0) ``` The connection still works fine, but the log entries don’t look good. This happens because older setups used `--redirect-gateway def1` in the advanced options, and remnants of this are still present in server.conf (push "redirect-gateway def1"), even though the checkbox for this option has disappeared. When creating a new client, you can enable in the specific client coniguration `--redirect-gateway` (without def1) now triggers this MULTI ERROR (“violates tunnel network/netmask constraint”) since two redirect-gateway directives has been set. Using `--redirect-gateway def1` might actually be the better and more modern approach, since it adds two more specific routes (0.0.0.0/1 and 128.0.0.0/1) instead of replacing the original default route — keeping it available as a fallback. → Should "redirect-gateway def1" therefore be pushed globally for all clients? If on client generation not explicitly configured, it would still apply. Otherwise, DCO seems to work fine so far. Some smaller issues have been noticed, but I think these are the key points. Hope this mail isn’t **too long**, but I thought it might be useful to share. Best, Erik
