Adding routes with gateways that have the same IP address

[kruton]

If there are multiple gateways where the IP address on the remote side of the VPN connection are the same, adding routes might point the route to the wrong logical gateway.

In src/openvpn/route.c "add_route", it only specifies "via %s" and not "dev %s" to ensure it's routing to the interface that OpenVPN just brought up.

I'm not sure if there is a downside to specifying the device explicitly. It seems to only do this if you don't have ENABLE_IPROUTE set and "is_local_route" is true. It might be worth eliminating some complexity here by always specifying it.

[krzee king]

are you saying you have multiple interfaces on multiple networks on the same subnet?
why would somebody do that?

[kruton]

No, if you're a client and the servers have picked the same address. (I agree it's not the most sane setup, but it is a problem if you can't get either server operator to change.)

[Gert Döring]

Use IPv6 :-) - the ipv6 routing code will actually use "dev %s" on tun interfaces...

The whole "setup route to <x>" code is problematic to change, as you can actually end up with routes that should be set outside the tun/tap interface, so just changing our logic to do "dev %s" for IPv4 as well is likely going to break someone's existing setup...

[Samuli Seppänen]

cron2: close as "wontfix"?

[Gert Döring]

Well, I think it is a legitimate request, but it's not easy or straightforward (due to the ambiguity of our current way of doing this, which people might want to keep).

I'll put it on my heap of things, but it won't happen "soonish".