Opened 3 years ago

Closed 3 years ago

#999 closed Bug / Defect (fixed)

iOS: app not routing entire VPN network

Reported by: karpuzvepeynir Owned by: Antonio
Priority: critical Milestone:
Component: OpenVPN Connect Version: OpenVPN Connect for iOS v1.2.6
Severity: Not set (select this one, unless your'e a OpenVPN developer) Keywords:
Cc:

Description

Openvpn runs on my Mikrotik CCR1016 router (ver 6.39.3) very well. Tunnelbrick on Mac, OpenVpn? GUI on Windows, OpenVpn? Client Free on Android can connect to the Mikrotik. They work fine also. OpenVpn? Connect on IOS used to work fine also before updated to 1.2.5. OpenVpn? Connect 1.2.6 is also not working.

Now, when IOS device connects to the Mikrotik like before, I can ping the IOS device from LAN. I also see dns and ping traffic to the dns servers. But, from the ios device to LAN, there is no traffic pass except to dns servers.

I've added "redirect-gateway def1" to ovpn client file. It's worked fine.

Attachments (3)

client.ovpn (478 bytes) - added by karpuzvepeynir 3 years ago.
client.log (2.9 KB) - added by karpuzvepeynir 3 years ago.
ios-client.log (2.9 KB) - added by karpuzvepeynir 3 years ago.

Download all attachments as: .zip

Change History (18)

Changed 3 years ago by karpuzvepeynir

Attachment: client.ovpn added

Changed 3 years ago by karpuzvepeynir

Attachment: client.log added

comment:1 Changed 3 years ago by plaisthos

Server is not pushing redirect-gateway nor does the client file include redirect-gateway. So the behaviour looks completely fine to me. If the previous version routed everything over VPN, that sounds more like a bug in previous version than this.

comment:2 Changed 3 years ago by karpuzvepeynir

I've added "redirect-gateway def1" to ovpn client file.

But all device traffic routes to LAN. This was for just testing. I don't want to use like that.

If I don't add the "redirect-gateway def1" to ovpn client file, device traffic to LAN will be routed to LAN via vpn server. But other traffic except LAN will be routed to internet. Am I right?

If you answer yes, I will say that Openvpn Connect 1.2.6 doesn't work like that.

comment:3 Changed 3 years ago by karpuzvepeynir

Device traffic to LAN does not to be routed to LAN via vpn server without "redirect-gateway def1".

This is the problem.

comment:4 in reply to:  3 Changed 3 years ago by Antonio

Replying to karpuzvepeynir:

Device traffic to LAN does not to be routed to LAN via vpn server without "redirect-gateway def1".

This is the problem.

what IP class does the "LAN" belong to? and what is the VPN range?

comment:5 Changed 3 years ago by karpuzvepeynir

LAN: 10.10.0.0/16
VPN range is same with lan.

Tunnelbrick on Mac, Openvpn Gui on Windows, Openvpn Client Free on Android works good with the same client conf file.

comment:6 Changed 3 years ago by plaisthos

Still neither the OpenVPN client config has 10.0.0.0/16 in it nor does the server push that route. So the behaviour is correct. I bet OpneVPN Connect and OpenVPN for Android on Android will behave as the iOS client.

comment:7 Changed 3 years ago by plaisthos

Since you blanked out your config we cannot really tell what is going on with the ips.

Changed 3 years ago by karpuzvepeynir

Attachment: ios-client.log added

comment:8 Changed 3 years ago by karpuzvepeynir

I've attached the ios client log file with local IPs, but not included real IP.

Tomorrow I will send the log of Openvpn Gui for Windows, if you wish. You will see that the server pushes the 10.10.0.0/16 route on Windows log file also.

comment:9 Changed 3 years ago by Antonio

Owner: set to Antonio
Status: newaccepted

This apparently is still a glitch in the Apple API.

When adding X/16 as interface IP it is expected to automatically create a route for the entire subnet, but apparently this does not happen and needs to be done "manually" (by the app).

comment:10 Changed 3 years ago by Antonio

Summary: iOS: Routing problem on Mikrotik running OpenVpniOS: app not routing entire VPN network

A fix will be shipped in the next release. Thanks

comment:11 Changed 3 years ago by Antonio

as a workaround for now you can push the route from your server with:

push "route <my network> <subnet mask>"

comment:12 Changed 3 years ago by karpuzvepeynir

Thanks for your understanding.

Is there a estimated date to next release?

comment:13 Changed 3 years ago by Antonio

v1.2.7 is being rolled out to the various AppStore? as we speak. Please test it once you have a chance to upgrade and update this ticket accordingly, if possible. Thanks!

comment:14 Changed 3 years ago by karpuzvepeynir

1.2.7 works now!

The route came back:
2018-01-31 08:46:26 NIP: adding (included) IPv4 route 10.10.0.0/16

Thank you so much ordex!

comment:15 Changed 3 years ago by Antonio

Resolution: fixed
Status: acceptedclosed

Glad to hear that and thanks for the update!
I am closing this ticket.

Note: See TracTickets for help on using tickets.