0

When connecting to our company's VPN and looking at the routing table I find this:

172.16.0.0      10.8.0.241      255.255.0.0     UG    0      0        0 tun0
10.8.0.241      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.241      255.255.255.0   UG    0      0        0 tun0

I think I understand the first line to be: A packet to the 172.16 network is dropped into the tun0 interface, but addressed to the gateway 10.8.0.241 which will take care of the rest.

The second line says explicitly that to get to 10.8.0.241, just drop it into tun0.

What I don't understand is why the last two lines cannot just be combined into

10.8.0.0        0.0.0.0      255.255.255.0   UG    0      0        0 tun0

to say that anything to 10.8 can just be dropped into the tunnel and the right machine will pick it up. Why must a packet to 10.8 first be explicitly handed over to the gateway of that same network? Is it that the 10.8.0.251 is kind of misused as a switch here, because it is actually the only machine directly connected to the other end of tun0 and knows ways how to move packets onwards for 10.8?

Improve this question

2 Answers 2

Reset to default
0

Before answering this questions let me explain the flags which are linked.

  • U (route is up)
  • H (target is a host)
  • G (use gateway)

Route 2 and 3 cannot be combined because you are informing the source machine to reach 10.8.0.241 directly (metric 0) and to reach any machine with the network ID 10.8.0.0/24 please use the gateway 10.8.0.241. I am not sure why are we forwarding pkts to default gateway but this might be the trick to inject reverse route on the gateway router / firewall.

Improve this answer
1
  • Does this not violate the expectation that a network like 10.8.0.0 is like a physical connection between all hosts on this network. In former times it was one physical BNC cable. Today we have switches. Targeting the gateway on the same networks seems like making up for a missing switch, and it would mean the 10.8.0.241 would have to have two interfaces both for the 10.8.0.0 network and it does actually more switching than routing? If I want to address, say 10.8.0.55, whether the endpoint *241 places it on the "wire" ore my machine should be the same --- or not?
    – Harald
    Apr 20, 2016 at 11:30
0

At a guess the topology of the network would be

Client => Internet => 10.8.0.241 => 10.8.0.0/24

When the VPN is established you can't directly connect to any host but the VPN endpoint via tun0. To send data to anything else in the 10.8.0.0/24 range you need to send it to the GW (10.8.0.241) which would then forward it on to the correct host.

This could be to give you an IP on the same network as the servers at the remote endpoint or so you can connect to other VPN clients.

Improve this answer
2
  • How can it be that hosts on the 10.8. are not reached when I drop a packet into the tun0 interface. Is this not switching by routing then?
    – Harald
    Apr 20, 2016 at 11:56
  • If the host does definitely exist then it could be being blocked by the VPN endpoint.
    – Jonathan Widdicombe
    May 12, 2016 at 10:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .