Attention is currently required from: ordex, plaisthos.
Hello cron2, plaisthos,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1787?usp=email
to look at the new patch set (#3).
Change subject: push: push route-gateway(s) for subnet-pool clients
......................................................................
push: push route-gateway(s) for subnet-pool clients
A subnet-pool client sits outside the --server / --server-ipv6 network,
so the global route-gateway (the server's own VPN IP) is off-link for
it. Replace it with a route-gateway, and for IPv6 a route-ipv6-gateway,
inside the client's own subnet, so the client's pushed routes install
on-link.
A host route to the server's own VPN IP is deliberately not pushed: it
is not needed to reach the networks behind the server. An admin whose
clients must reach the server's VPN address itself can add an explicit
push "route ..." to the server config.
Change-Id: I7c0ff48fb019ac7c2d1d981b7b7e4578ff5dce48
GitHub: closes openvpn/OpenVPN#987
Signed-off-by: Antonio Quartulli <[email protected]>
---
M src/openvpn/push.c
1 file changed, 23 insertions(+), 0 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/87/1787/3
diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index e391147..9057710 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -645,6 +645,16 @@
print_in6_addr(c->c2.push_ifconfig_ipv6_local, 0, gc),
c->c2.push_ifconfig_ipv6_netbits,
print_in6_addr(c->c2.push_ifconfig_ipv6_remote, 0,
gc));
+
+ /* subnet-pool-ipv6 counterpart of the IPv4 push below: replace the
+ * global route-ipv6-gateway (the server's VPN IP, off-link for this
+ * client) with one inside the client's own subnet. */
+ if (o->subnet_pool_ipv6_defined)
+ {
+ push_remove_option(o, "route-ipv6-gateway");
+ push_option_fmt(gc, push_list, M_USAGE, "route-ipv6-gateway %s",
+ print_in6_addr(o->subnet_pool_ipv6_gateway, 0,
gc));
+ }
}
/* ipv4 */
@@ -659,6 +669,19 @@
push_option_fmt(gc, push_list, M_USAGE, "ifconfig %s %s",
print_in_addr_t(ifconfig_local, 0, gc),
print_in_addr_t(c->c2.push_ifconfig_remote_netmask, 0,
gc));
+
+ /* A subnet-pool client sits outside the --server network, so the
+ * global route-gateway (the server's own VPN IP) is off-link for it:
+ * replace it with one inside the client's own subnet so that its
+ * pushed routes install on-link. A host route to the server's VPN IP
+ * is deliberately not pushed (not needed to reach the networks behind
+ * the server); an admin who needs it adds an explicit push "route". */
+ if (o->subnet_pool_defined)
+ {
+ push_remove_option(o, "route-gateway");
+ push_option_fmt(gc, push_list, M_USAGE, "route-gateway %s",
+ print_in_addr_t(o->subnet_pool_gateway, 0, gc));
+ }
}
if (tls_multi->use_peer_id)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1787?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I7c0ff48fb019ac7c2d1d981b7b7e4578ff5dce48
Gerrit-Change-Number: 1787
Gerrit-PatchSet: 3
Gerrit-Owner: ordex <[email protected]>
Gerrit-Reviewer: cron2 <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: ordex <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
