Project

General

Profile

Actions

Bug #13624

open

Only one alias in local network of OpenVPN Server works in 2.6.0

Added by Florian Bat 3 months ago. Updated 3 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
OpenVPN
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.6.0
Affected Architecture:
amd64

Description

Issue #2668 implemented the possibility to have host/network aliases in the OpenVPN local/remote/tunnel network fields.

When using host aliases in the local network field, it seems only the hosts of the very first alias are pushed to the client as local network. all other aliases seem to be ignored.

Example:
Let's say I have 3 host alias lists (named alias1, alias2 and alias3) with 2 hosts defined in each alias.

Using this as "local network" in the OpenVPN Server definition only pushes the ips of the alias1 list.

alias1, alias2, alias3

This only pushes the hosts of alias2:

alias2, alias3, alias1

And this would push the two hosts of alias1 plus the 192.168.1.0/24 and 192.168.2.0/24 networks as local networks.

alias1, alias2, 192.168.1.0/24, alias3, 192.168.2.0/24

I am using
2.6.0-RELEASE (amd64)
built on Mon Jan 31 19:57:53 UTC 2022
FreeBSD 12.3-STABLE

Actions #1

Updated by Jim Pingle 3 months ago

Not saying this shouldn't be looked into, but in most cases only one alias is necessary -- create a new alias which itself contains the other three, and then only reference the one alias in OpenVPN.

For example if you have alias1, alias2, and alias3, then create alias_1_3 which has alias1, alias2, and alias3 as entries.

Actions #2

Updated by Florian Bat 3 months ago

Yes, i can confirm. Only using one alias, which contains the other aliases works and expands all of them.
Ok, this "fixes" it for me, although this is not expected behaviour, since the explanation of the field "local networks" states:

...Expressed as a comma-separated list of one or more CIDR ranges or host/network type aliases...

So I thought i could enter several aliases.

If someone still wants to look into this - it must be the code that expands the aliases:

Looking into /var/etc/openvpn/server1/config.ovpn it looks like this for my first example above

push "route 1.2.3.4 255.255.255.0" 
push "route 1.2.3.5 255.255.255.0" 
push "route alias2 0.0.0.0" 
push "route alias3 0.0.0.0" 

So the first alias1 is replaced with the correct ips, the other aliases are simply not expanded to the list of hosts.

Actions #3

Updated by Jim Pingle 3 months ago

That is definitely undesirable behavior, but at least it's fairly simple to work around. I'm surprised OpenVPN even accepted those route statements rather than failing to run entirely.

Actions #4

Updated by Florian Bat 3 months ago

A note about the "workaround":

If you have setup a "meta"-alias, that holds the subaliases as suggested by Jim, adding a host afterwards in one of the aliases will NOT update the local network config.

Only if you ALSO edit/save the master alias afterwards (just open and save it) the expansion of all the hosts will happen in the openvpn config.

Actions

Also available in: Atom PDF