Opened 6 years ago
Closed 6 years ago
#999 closed Bug / Defect (fixed)
iOS: app not routing entire VPN network
| Reported by: | karpuzvepeynir | Owned by: | Antonio Quartulli |
|---|---|---|---|
| Priority: | critical | Milestone: | |
| Component: | OpenVPN Connect | Version: | OpenVPN Connect for iOS v1.2.6 |
| Severity: | Not set (select this one, unless your'e a OpenVPN developer) | Keywords: | |
| Cc: |
Description
Openvpn runs on my Mikrotik CCR1016 router (ver 6.39.3) very well. Tunnelbrick on Mac, OpenVpn? GUI on Windows, OpenVpn? Client Free on Android can connect to the Mikrotik. They work fine also. OpenVpn? Connect on IOS used to work fine also before updated to 1.2.5. OpenVpn? Connect 1.2.6 is also not working.
Now, when IOS device connects to the Mikrotik like before, I can ping the IOS device from LAN. I also see dns and ping traffic to the dns servers. But, from the ios device to LAN, there is no traffic pass except to dns servers.
I've added "redirect-gateway def1" to ovpn client file. It's worked fine.
Attachments (3)
Change History (18)
Changed 6 years ago by
| Attachment: | client.ovpn added |
|---|
Changed 6 years ago by
| Attachment: | client.log added |
|---|
comment:1 Changed 6 years ago by
comment:2 Changed 6 years ago by
I've added "redirect-gateway def1" to ovpn client file.
But all device traffic routes to LAN. This was for just testing. I don't want to use like that.
If I don't add the "redirect-gateway def1" to ovpn client file, device traffic to LAN will be routed to LAN via vpn server. But other traffic except LAN will be routed to internet. Am I right?
If you answer yes, I will say that Openvpn Connect 1.2.6 doesn't work like that.
comment:3 follow-up: 4 Changed 6 years ago by
Device traffic to LAN does not to be routed to LAN via vpn server without "redirect-gateway def1".
This is the problem.
comment:4 Changed 6 years ago by
Replying to karpuzvepeynir:
Device traffic to LAN does not to be routed to LAN via vpn server without "redirect-gateway def1".
This is the problem.
what IP class does the "LAN" belong to? and what is the VPN range?
comment:5 Changed 6 years ago by
LAN: 10.10.0.0/16
VPN range is same with lan.
Tunnelbrick on Mac, Openvpn Gui on Windows, Openvpn Client Free on Android works good with the same client conf file.
comment:6 Changed 6 years ago by
Still neither the OpenVPN client config has 10.0.0.0/16 in it nor does the server push that route. So the behaviour is correct. I bet OpneVPN Connect and OpenVPN for Android on Android will behave as the iOS client.
comment:7 Changed 6 years ago by
Since you blanked out your config we cannot really tell what is going on with the ips.
Changed 6 years ago by
| Attachment: | ios-client.log added |
|---|
comment:8 Changed 6 years ago by
I've attached the ios client log file with local IPs, but not included real IP.
Tomorrow I will send the log of Openvpn Gui for Windows, if you wish. You will see that the server pushes the 10.10.0.0/16 route on Windows log file also.
comment:9 Changed 6 years ago by
| Owner: | set to Antonio Quartulli |
|---|---|
| Status: | new → accepted |
This apparently is still a glitch in the Apple API.
When adding X/16 as interface IP it is expected to automatically create a route for the entire subnet, but apparently this does not happen and needs to be done "manually" (by the app).
comment:10 Changed 6 years ago by
| Summary: | iOS: Routing problem on Mikrotik running OpenVpn → iOS: app not routing entire VPN network |
|---|
A fix will be shipped in the next release. Thanks
comment:11 Changed 6 years ago by
as a workaround for now you can push the route from your server with:
push "route <my network> <subnet mask>"
comment:12 Changed 6 years ago by
Thanks for your understanding.
Is there a estimated date to next release?
comment:13 Changed 6 years ago by
v1.2.7 is being rolled out to the various AppStore? as we speak. Please test it once you have a chance to upgrade and update this ticket accordingly, if possible. Thanks!
comment:14 Changed 6 years ago by
1.2.7 works now!
The route came back:
2018-01-31 08:46:26 NIP: adding (included) IPv4 route 10.10.0.0/16
Thank you so much ordex!
comment:15 Changed 6 years ago by
| Resolution: | → fixed |
|---|---|
| Status: | accepted → closed |
Glad to hear that and thanks for the update!
I am closing this ticket.
Server is not pushing redirect-gateway nor does the client file include redirect-gateway. So the behaviour looks completely fine to me. If the previous version routed everything over VPN, that sounds more like a bug in previous version than this.