0

I am trying to set up a VPN connection to an OpenVPN server, but without any default routes, so I can configure those myself. Basically what I'm looking for is a mostly unchanged system (all routing as before), but with the interface tun0 present so an application can connect to it.

The configuration file I'm starting with looks like this:

client
dev tun
proto udp

remote de-fra.mullvad.net 1194

cipher AES-256-CBC
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3
remote-cert-tls server
ping 10
ping-restart 60
sndbuf 524288
rcvbuf 524288

fast-io

auth-user-pass mullvad_userpass.txt
ca mullvad_ca.crt

tun-ipv6
script-security 2

tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA

It is adapted from the default Mullvad configuration file, with the calls to update-resolv-conf.sh removed (the rationale being that this is not mentioned in most OpenVPN guides and I want as little interference with my system as possible).

ec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: /sbin/ip -6 addr add fdda:d0d0:cafe:1194::1000/64 dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: add_route_ipv6(::/2 -> fdda:d0d0:cafe:1194:: metric -1) dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: /sbin/ip -6 route add ::/2 dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: add_route_ipv6(4000::/2 -> fdda:d0d0:cafe:1194:: metric -1) dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: /sbin/ip -6 route add 4000::/2 dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: add_route_ipv6(8000::/2 -> fdda:d0d0:cafe:1194:: metric -1) dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: /sbin/ip -6 route add 8000::/2 dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: add_route_ipv6(c000::/2 -> fdda:d0d0:cafe:1194:: metric -1) dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: /sbin/ip -6 route add c000::/2 dev tun0
Dec 25 11:52:39 Hurler ovpn-mullvad_de-fra[8378]: Initialization Sequence Completed

Where do these routes come from?

3
  • Just an FYI, your config is an inefficient bottleneck for throughput. There is no legitimate reason to use anything greater than AES128 for the SSL & TLS ciphers, as AES128 will remain uncrackable for at least a decade, if not longer; If you're super paranoid about the security of the data, lower the rekey values. There's also no HMAC authentication (auth sha256 for x86, auth sha512 for x64), of which prevents MITM attacks.
    – JW0914
    Dec 28 '19 at 16:25
  • Thanks! I'm currently just using the configuration Mullvad gave me.
    – Paul
    Feb 12 '20 at 20:07
  • 1
    Just an FYI: There's no point in running encryption higher than AES128, as it will remain uncrackable through 2030 at the minimum... all you're doing is massively slowing throughput to a crawl with AES256. Mullvad is either not using OpenVPN 2.4, which was released ~4yrs ago, of which enabled the usage of the vastly more efficient TLS EC ciphers, or they've improperly configured the client config, as AFAIK, tls-cipher must be specified in the server config, not client config. I'm also not sure why they're using a SHA384 cipher suite, as it's not in common use.
    – JW0914
    Feb 13 '20 at 12:15
1

Answering the why of "Where do these routes come from?"

Looking at the routes:

0000::/2
4000::/2
8000::/2
c000::/2

Those four /2 subnets represent the whole IPv6 Internet. That's a (bit hacky) way to override the default route (which would be ::/0) without deleting it. Many OpenVPN configurations do the same for IPv4, by adding those routes:

0.0.0.0/1
128.0.0.0/1

This allows to still have precedence over 0.0.0.0/0 (or ::/0) if the default route metric were also the lowest possible: 0.

This link gives ways to prevent this on the client side:

https://community.openvpn.net/openvpn/wiki/IgnoreRedirectGateway

0

OpenVPN servers can push settings such as routes to clients.

You can theoretically filter which wille be accepted by your client using pull filters, however this was not what worked in my case.

I needed the directive route-nopull.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.