Project

General

Profile

Actions
Copy link

Bug #16705

closed

Automatic gateways for OpenVPN peer-to-peer servers with a ``/30`` tunnel network do not use the peer address

Added by Georgiy Tyutyunnik 2 days ago. Updated about 7 hours ago.

Status:
Resolved
Priority:
Normal
Assignee:
Marcos M
Category:
OpenVPN
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.03
Release Notes:
Default
Affected Version:
2.9.0
Affected Architecture:

Description

re-created from https://redmine.netgate.com/issues/22042

OpenVPN SSL/TLS Site-2-Site scenario with /30 subnet and only one client behaves differently in 25.11.1 in comparison to 24.11
Previously you didn't need to manually create gateways and cso to communicate with 1 peer using the server with /30 subnet.
OpenVPN config and resulting interfaces and gateways from 24.11 and 25.11 attached

consistently reproducable this behavior.

Environment:

OpenVPN site-to-site configuration
Two peers only
Tunnel network defined as: 192.168.72.0/30
Interface type: assigned OpenVPN (ovpns) interface
Behavior in 24.11-RELEASE Expected / Working
The assigned OpenVPN (ovpns) interface received:

Interface IP: 192.168.72.1
Gateway: 192.168.72.2 (remote peer tunnel IP)
Static routes that used the OpenVPN gateway worked correctly.
Connectivity to the remote peer’s local subnet was fully functional (ping and routing OK).

Interfaces, gateways, openvpn configs and screenshots are attached

Files

Download all files
issue-22042-attachments.zip (190 KB) issue-22042-attachments.zip Georgiy Tyutyunnik, 02/17/2026 04:50 PM
25-07ovpn.xml (3.65 KB) 25-07ovpn.xml Georgiy Tyutyunnik, 02/17/2026 04:52 PM
25-11ovpn.xml (3.57 KB) 25-11ovpn.xml Georgiy Tyutyunnik, 02/17/2026 04:52 PM
clipboard-202602170912-pazaa.png (55.5 KB) clipboard-202602170912-pazaa.png Georgiy Tyutyunnik, 02/17/2026 04:52 PM
clipboard-202602170931-rsc9z.png (45.9 KB) clipboard-202602170931-rsc9z.png Georgiy Tyutyunnik, 02/17/2026 04:52 PM
clipboard-202602170913-by7na.png (53.9 KB) clipboard-202602170913-by7na.png Georgiy Tyutyunnik, 02/17/2026 04:52 PM
clipboard-202602170933-t7vmy.png (48.1 KB) clipboard-202602170933-t7vmy.png Georgiy Tyutyunnik, 02/17/2026 04:52 PM
config_ovpn_2507.txt (835 Bytes) config_ovpn_2507.txt Georgiy Tyutyunnik, 02/17/2026 04:52 PM
config_ovpn_2511.txt (841 Bytes) config_ovpn_2511.txt Georgiy Tyutyunnik, 02/17/2026 04:52 PM
Actions
Copy link
 #1

Updated by Jim Pingle 2 days ago

Could be related to the recent changes in OpenVPN gateways in #16351

Actions
Copy link
 #2

Updated by Danilo Zrenjanin 1 day ago

I replicated this behaviour.

Environment

  • OpenVPN site-to-site configuration
  • Two peers only
  • Tunnel network defined as: 192.168.72.0/30
  • Interface type: assigned OpenVPN (ovpns) interface

Behavior in 24.11-RELEASE Expected / Working

The assigned OpenVPN (ovpns) interface received:

  • Interface IP: 192.168.72.1
  • Gateway: 192.168.72.2 (remote peer tunnel IP)
  • Static routes that used the OpenVPN gateway worked correctly.
  • Connectivity to the remote peer’s local subnet using static routes was fully functional (ping and routing OK).

Behavior After Upgrade to 25.11.1-RELEASE (Incorrect)

  • The OpenVPN gateway is now automatically set to: 192.168.72.1 (the local ovpns interface address)
  • Previously, it was correctly set to 192.168.72.2 (the remote peer tunnel address)

Because of this change:

  • Static routes point to the wrong gateway.
  • Traffic to the remote peer’s local subnet fails.
  • Ping and routing over the site-to-site tunnel no longer work.
Actions
Copy link
 #3

Updated by Marcos M 1 day ago

  • Subject changed from OpenVPN s2s interface and gateway assignment to Gateways for OpenVPN S2S Servers are not created with the peer address
  • Status changed from Confirmed to Feedback
  • Assignee set to Marcos M
  • Target version set to 2.9.0
  • % Done changed from 0 to 100
  • Plus Target Version set to 26.03
  • Affected Version set to 2.9.0
Actions
Copy link
 #4

Updated by Danilo Zrenjanin about 10 hours ago

  • Status changed from Feedback to Resolved

The patch fixes it.

Thanks!

I am closing this case as resolved.

Actions
Copy link
 #5

Updated by Jim Pingle about 7 hours ago

  • Subject changed from Gateways for OpenVPN S2S Servers are not created with the peer address to Automatic gateways for OpenVPN peer-to-peer servers with a ``/30`` tunnel network do not use the peer address
Actions
Copy link

Also available in: Atom PDF