Gateway pushed by OpenVPN is automatically replaced

Question

I'm using OpenVPN as gateway and it works perfectly - connection is successful, routes are set and forwarding is working. But some clients have problem with gateway (two different windows PC on same network).

Both clients have two adapters - first is ethernet, second is VPN. OpenVPN working properly - default route to ethernet is removed and new one to virtual adapter is created. But after a while (couple of minutes) something will create route back to ethernet.

I tried set to metric on both adapters (ethernet had 200, virtual adapter 100) but the new route to ethernet was created with metric 99.

How i can disable this behaviour? Why is gateway always set back to ethernet and why is this happening only at one network?

Could you please post OpenVPN settings and client's ccd push commands you use. — Glueon, Oct 25 '14 at 11:54
setting is pretty default - i have just push redirect-gateway def1 and no extra configuration for clients (no cdd) — user3332640, Oct 25 '14 at 14:57
now i have routes from the-wabbit as ccd for clients on the weird networking and everything working like charm — user3332640, Oct 27 '14 at 18:16

score 1 · Answer 1 · answered Oct 25 '14 at 11:01

1

Maybe try to specify metric lower than 99 in "pushed" route at server config?

push "route network/IP [netmask] [gateway] [metric]"

answered Oct 25 '14 at 11:01

V0rd

11
1

not working, when i have metric 10, then "automatic" gateway have 9 - it's always less than metric of virtual adapter – user3332640 Oct 25 '14 at 11:15

score 1 · Accepted Answer · answered Oct 25 '14 at 12:13

The most likely reason for a default route reset is that some service or program is reconfiguring your system accordingly (you might have another VPN client running, some group policy in place, strange DHCP settings at work or something else entirely).

You might try working around this by pushing four /2 network routes through OpenVPN - this way the default route is not going to ever be used as more specific routes would be available for all destinations:

push "route 0.0.0.0 192.0.0.0"
push "route 64.0.0.0 192.0.0.0"
push "route 128.0.0.0 192.0.0.0"
push "route 192.0.0.0 192.0.0.0"

AFAIR you can't use a /1 netmask as some OSes (might be Windows clients, although I have to admit that I don't remember) would not accept the addition of a /1 route to the routing table.

this is probably what i was looking for, 1 hour gone and gateway is still alive, thanks! — user3332640, Oct 27 '14 at 18:14

Gateway pushed by OpenVPN is automatically replaced

2 Answers2