# openvpn and dhcdcd 5.2 [found work around]

## RayDude

I recently had to upgrade to DHCPCD 5.2 from 4.x. I have resolved some issues (like adding dhcpcd to rc startup scripts). But openvpn is not working. This configuration worked fine with the old DHCPCD but with the new one I get "No Route to host" messages after I connect. I can ping the tap eth addr but not any thing in the destination domain.

Its a long shot, but has anyone seen this? I need to connect to work and my Gentoo's being a biotch.

Brian

----------

## RayDude

Bump with new info.

After I start openvpn, the route command hangs. But it works fine when openvpn is not running. So clearly the kernel is having issues.

----------

## RayDude

BUMP

Help?

----------

## UberLord

If OpenVPN replaces the default route then your network will loose the route to the VPN host.

Is this what is happening?

----------

## RayDude

 *UberLord wrote:*   

> If OpenVPN replaces the default route then your network will loose the route to the VPN host.
> 
> Is this what is happening?

 

Thanks for replying. The /etc/resolv.conf file is correct after starting openvpn. Plus I have openvpn running on my home server and that works fine. But for some reason when I connect to work from home, all routing stops. If I attempt a route command it hangs. To restore routing I have to stop openvpn.

What else can I do to debug this issue?

Brian

PS three things have changed since it worked that I can think might relate: the kernel switched to 3.0.X, DHCP changed to 5.X.X and openvpn itself updated (I think).

----------

## UberLord

Post the routing table and interface addresses for both before and after OpenVPN connects. That should show where the issue is.

----------

## RayDude

Before /etc/init.d/openvpn.blah start

```

 ~ # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

 ~ # ifconfig

eth0      Link encap:Ethernet  HWaddr 00:23:df:a0:3f:56  

          UP BROADCAST MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

          Interrupt:46 Base address:0xa000 

eth1      Link encap:Ethernet  HWaddr 00:23:6c:99:e7:83  

          inet addr:10.1.10.17  Bcast:10.1.10.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:35699 errors:0 dropped:0 overruns:0 frame:951399

          TX packets:26267 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:26730551 (25.4 MiB)  TX bytes:4796918 (4.5 MiB)

          Interrupt:22 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:8 errors:0 dropped:0 overruns:0 frame:0

          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:400 (400.0 B)  TX bytes:400 (400.0 B)

tunl0     Link encap:IPIP Tunnel  HWaddr   

          UP RUNNING NOARP  MTU:1480  Metric:1                                  

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0                    

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0                  

          collisions:0 txqueuelen:0                                             

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)                                

                                                                                

vmnet1    Link encap:Ethernet  HWaddr 00:50:56:c0:00:01  

          inet addr:172.16.137.1  Bcast:172.16.137.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:39 errors:0 dropped:0 overruns:0 frame:0

          TX packets:79 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet8    Link encap:Ethernet  HWaddr 00:50:56:c0:00:08  

          inet addr:192.168.69.1  Bcast:192.168.69.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:39 errors:0 dropped:0 overruns:0 frame:0

          TX packets:79 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

```

After:

```

 ~ # ifconfig

eth0      Link encap:Ethernet  HWaddr 00:23:df:a0:3f:56  

          UP BROADCAST MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

          Interrupt:46 Base address:0xa000 

eth1      Link encap:Ethernet  HWaddr 00:23:6c:99:e7:83  

          inet addr:10.1.10.17  Bcast:10.1.10.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:35923 errors:0 dropped:0 overruns:0 frame:962649

          TX packets:26477 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:26789433 (25.5 MiB)  TX bytes:4843212 (4.6 MiB)

          Interrupt:22 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:8 errors:0 dropped:0 overruns:0 frame:0

          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:400 (400.0 B)  TX bytes:400 (400.0 B)

tap0      Link encap:Ethernet  HWaddr 46:3c:69:1f:61:1c  

          inet addr:10.1.4.218  Bcast:10.1.4.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:8 errors:0 dropped:1 overruns:0 frame:0

          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:1922 (1.8 KiB)  TX bytes:792 (792.0 B)

tunl0     Link encap:IPIP Tunnel  HWaddr   

          UP RUNNING NOARP  MTU:1480  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet1    Link encap:Ethernet  HWaddr 00:50:56:c0:00:01  

          inet addr:172.16.137.1  Bcast:172.16.137.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:39 errors:0 dropped:0 overruns:0 frame:0

          TX packets:79 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet8    Link encap:Ethernet  HWaddr 00:50:56:c0:00:08  

          inet addr:192.168.69.1  Bcast:192.168.69.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:39 errors:0 dropped:0 overruns:0 frame:0

          TX packets:79 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000 

          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.4.254      0.0.0.0         UG    209    0        0 tap0

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.2.0        10.1.4.254      255.255.254.0   UG    0      0        0 tap0

10.1.4.0        *               255.255.255.0   U     209    0        0 tap0

10.1.5.0        10.1.4.254      255.255.255.0   UG    0      0        0 tap0

10.1.6.0        10.1.4.254      255.255.255.0   UG    0      0        0 tap0

10.1.7.0        10.1.4.254      255.255.255.0   UG    0      0        0 tap0

10.1.8.0        10.1.4.254      255.255.255.0   UG    0      0        0 tap0

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

```

It takes minutes to run the route command. pings don't really seem to work.

Thanks for your help.

----------

## UberLord

You need to set a higher metric for OpenVPN or a lower one for eth1.

Basically the lowest metric wins, so everything is going over your vpn, and eventually your vpn will try to go over itself and fail.

----------

## RayDude

Thanks for the quick response, but it didn't work:

First I set the openvpn metric to 1000:

```

openvpn # /etc/init.d/openvpn.blah restart

openvpn.blah| * Stopping openvpn.blah ...                     [ ok ]

openvpn.blah| * Starting openvpn.blah ...

openvpn.blah|Enter Private Key Password:                            [ ok ]

openvpn.blah| * WARNING: openvpn.blah has started, but is inactive

 openvpn # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.2.0        10.1.4.254      255.255.254.0   UG    1000   0        0 tap0

10.1.4.0        *               255.255.255.0   U     0      0        0 tap0

10.1.5.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.6.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.7.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.8.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

 openvpn # ping build2

ping: unknown host build2

 openvpn # ping build2

^C

 openvpn # ping build2.blah.lan

^C

 openvpn # ping www.yahoo.com

^C

 openvpn # /etc/init.d/openvpn.blah stop

openvpn.blah| * Stopping openvpn.blah ...                     [ ok ]

```

Then I tried 80:

```

 openvpn # nano -w blah.conf

 openvpn # /etc/init.d/openvpn.blah start

openvpn.blah| * Starting openvpn.blah ...

openvpn.blah|Enter Private Key Password:                            [ ok ]

openvpn.blah| * WARNING: openvpn.blah has started, but is inactive

 openvpn # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

 openvpn # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.2.0        10.1.4.254      255.255.254.0   UG    80     0        0 tap0

10.1.4.0        *               255.255.255.0   U     0      0        0 tap0

10.1.5.0        10.1.4.254      255.255.255.0   UG    80     0        0 tap0

10.1.6.0        10.1.4.254      255.255.255.0   UG    80     0        0 tap0

10.1.7.0        10.1.4.254      255.255.255.0   UG    80     0        0 tap0

10.1.8.0        10.1.4.254      255.255.255.0   UG    80     0        0 tap0

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

 openvpn # ping build2

^C

 openvpn # ping www.yahoo.com

```

No connectivity in either case.

----------

## UberLord

So you probably have DNS information coming from OpenVPN as well, which could be stamping on your own.

Try installing openresolv to manage this - dhcpcd and OpenVPN both support it.

If you already have openresolv installed, try listing the output like so

```
resolvconf -l

cat /etc/resolv.conf
```

----------

## RayDude

Thanks! That's a great tool. I had no idea it existed.

However, even though resolv.conf is correct, I still can't get to any network when connected through openvpn (even with openvpn having a higher metric).

I can ping tap0, but I can't ping anything that should be routed through tap0.

I don't know if it matters but eth1 is a wireless interface running on the Broadcom WL kernel module.

If you have any more ideas, please let me know. I really appreciate your help with this.

```

blah conf.d # /etc/init.d/openvpn.blah restart

openvpn.blah| * Stopping openvpn.blah ...                     [ ok ]

openvpn.blah| * Starting openvpn.blah ...

openvpn.blah|Enter Private Key Password:                            [ ok ]

openvpn.blah| * WARNING: openvpn.blah has started, but is inactive

blah conf.d # cat /etc/resolv.conf

# Generated by resolvconf

search blah.org

nameserver 10.1.10.1

nameserver 68.87.76.178

nameserver 68.87.78.130

blah conf.d # cat /etc/resolv.conf

# Generated by resolvconf

search blah.org

nameserver 10.1.10.1

nameserver 68.87.76.178

nameserver 68.87.78.130

blah conf.d # cat /etc/resolv.conf

# Generated by resolvconf

search blah.lan blah.org

nameserver 10.1.10.1

nameserver 10.1.4.7

nameserver 10.1.4.16

nameserver 68.87.76.178

nameserver 68.87.78.130

blah conf.d # ping 10.1.10.1

PING 10.1.10.1 (10.1.10.1) 56(84) bytes of data.

64 bytes from 10.1.10.1: icmp_req=1 ttl=64 time=3.89 ms

64 bytes from 10.1.10.1: icmp_req=2 ttl=64 time=1.12 ms

^C

--- 10.1.10.1 ping statistics ---

2 packets transmitted, 2 received, 0% packet loss, time 1001ms

rtt min/avg/max/mdev = 1.129/2.510/3.892/1.382 ms

blah conf.d # ping 10.1.4.16

PING 10.1.4.16 (10.1.4.16) 56(84) bytes of data.

^C

--- 10.1.4.16 ping statistics ---

3 packets transmitted, 0 received, 100% packet loss, time 1998ms

blah conf.d # ifconfig tap0

tap0      Link encap:Ethernet  HWaddr 72:5d:aa:10:29:ce  

          inet addr:10.1.4.218  Bcast:10.1.4.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:12 errors:0 dropped:3 overruns:0 frame:0

          TX packets:56 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:3022 (2.9 KiB)  TX bytes:3351 (3.2 KiB)

blah conf.d # ping 10.1.4.218

PING 10.1.4.218 (10.1.4.218) 56(84) bytes of data.

64 bytes from 10.1.4.218: icmp_req=1 ttl=64 time=0.046 ms

64 bytes from 10.1.4.218: icmp_req=2 ttl=64 time=0.044 ms

64 bytes from 10.1.4.218: icmp_req=3 ttl=64 time=0.042 ms

^C

--- 10.1.4.218 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2000ms

rtt min/avg/max/mdev = 0.042/0.044/0.046/0.001 ms

blah conf.d # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.4.254      0.0.0.0         UG    212    0        0 tap0

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.2.0        10.1.4.254      255.255.254.0   UG    1000   0        0 tap0

10.1.4.0        *               255.255.255.0   U     212    0        0 tap0

10.1.5.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.6.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.7.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.8.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

blah conf.d # /etc/init.d/openvpn.blah stop

openvpn.blah| * Stopping openvpn.blah ...                     [ ok ]

```

----------

## RayDude

*bump*

Now it seems that I can't even run at work... pings and route commands run very very slowly.

No one else is having this problem.

----------

## RayDude

So I'm getting this message in /var/log/messages:

```

Sep 21 08:33:07 blah vmnetBridge: Started bridge eth0 to virtual network 0.

Sep 21 08:33:07 blah dhcpcd[5713]: eth0: rebinding lease of 10.1.3.110

Sep 21 08:33:07 blah dhcpcd[5713]: eth0: acknowledged 10.1.3.110 from 10.1.4.2

Sep 21 08:33:07 blah dhcpcd[5713]: eth0: checking for 10.1.3.110

Sep 21 08:33:07 blah start-stop-daemon: pam_unix(start-stop-daemon:session): session opened for user nobody by blah(uid=0)

Sep 21 08:33:07 blah netplugd[9180]: /etc/netplug.d/netplug eth0 in -> pid 9180

Sep 21 08:33:07 blah /etc/init.d/net.eth0[8908]: ERROR: net.eth0 failed to start

Sep 21 08:33:07 blah /etc/init.d/net.eth0[9243]: You are using a bash array for config_eth0.

Sep 21 08:33:07 blah /etc/init.d/net.eth0[9244]: This feature will be removed in the future.

Sep 21 08:33:07 blah /etc/init.d/net.eth0[9245]: Please see net.example for the correct format for config_eth0.

```

But I don't have /etc/conf.d/net.example. Where can I get it?

----------

## UberLord

I don't use Gentoo anymore, so I cannot say.

But seriously - you need to ensure that your tap0 routes have a higher metric than your eth1 routes

----------

## RayDude

Thanks much for your help Uber. I'll keep plugging at it. Right now I'm hard wired to my work network and things are clunky. Makes me wonder if there's a router problem or something.

----------

## RayDude

Hey Uber,

Out of curiosity, what distro are you using?

----------

## RayDude

You're right Uber, its a Metric issue. It works for a few seconds after I connect and then somehow the route changes:

```

blah ~ # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

blah ~ # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.2.0        10.1.4.254      255.255.254.0   UG    1000   0        0 tap0

10.1.4.0        *               255.255.255.0   U     0      0        0 tap0

10.1.5.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.6.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.7.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.8.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

blah ~ # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.1.4.254      0.0.0.0         UG    213    0        0 tap0

default         10.1.10.1       0.0.0.0         UG    304    0        0 eth1

10.1.2.0        10.1.4.254      255.255.254.0   UG    1000   0        0 tap0

10.1.4.0        *               255.255.255.0   U     213    0        0 tap0

10.1.5.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.6.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.7.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.8.0        10.1.4.254      255.255.255.0   UG    1000   0        0 tap0

10.1.10.0       *               255.255.255.0   U     304    0        0 eth1

loopback        blah.blah 255.0.0.0       UG    0      0        0 lo

172.16.137.0    *               255.255.255.0   U     205    0        0 vmnet1

192.168.69.0    *               255.255.255.0   U     206    0        0 vmnet8

```

You can see in the middle table (the one that works) eth1 has higher priority, but then the route changes giving tap0 highest priority and messes everything up.

I have to figure this out.

I wonder if iproute2 would do a better job... Never used it before.

----------

## cach0rr0

 *RayDude wrote:*   

> Hey Uber,
> 
> Out of curiosity, what distro are you using?

 

N/A

I would assume he's using NetBSD as his flavor of choice

Which makes it all the more awesome that he takes the time to still pop in here and help out! *I* appreciate it at least.

----------

## RayDude

Here's a work around. I'm not sure why its necessary, but it works:

```

route del -net default gw 10.1.4.254 netmask 0.0.0.0 tap0

route add -net default gw 10.1.4.254 metric 1000 netmask 0.0.0.0 tap0

```

I can't seem to control the metric of either the tap (by setting it in the openvpn conf file) or the wireless adapter by setting it in /etc/conf.d/net

But route can set the metric.

Thanks for all your help Uberlord!

Brian

----------

