I'm running an OpenVPN client from my home broadband. I need to forward DNS resolution to my home broadband provider, however they only allow their own client networks to query their DNS resolvers. Therefore, I need to ensure that this traffic doesn't go through the OpenVPN tunnel but stays on the broadband.
Easy enough to configure:
route dns3.telefonica.de 255.255.255.255 net_gateway
route-ipv6 dns3.telefonica.de/128 net_gateway_ipv6
Given
# host dns3.telefonica.de
dns3.telefonica.de has address 62.109.121.1
dns3.telefonica.de has IPv6 address 2a01:c30::530
the result is wrong however:
# netstat -rn | egrep '62.109.121.1|2a01:c30::530|Dest'
Destination Gateway Flags Netif Expire
62.109.121.1 192.168.178.1 UGHS re0
Destination Gateway Flags Netif Expire
2a01:c30::530 link#4 UHS tun0
Clearly visible that the IPv4 case is correct (and I have verified it works) but the IPv6 case points to the tunnel (tun0) instead of the broadband (re0) interface.
There's been some discussion around this years ago. However the patch provided (applies to OpenVPN 2.6) had not been committed apparently, and is also not committed to 2.7. I have modified this patch slightly so that it applies cleanly to 2.7.1, see patch.patch. With the patch applied, the result is correct:
# netstat -rn | egrep '62.109.121.1|2a01:c30::530|Dest'
Destination Gateway Flags Netif Expire
62.109.121.1 192.168.178.1 UGHS re0
Destination Gateway Flags Netif Expire
2a01:c30::530 fe80::5e49:79ff:fecc:ecf3%re0 UGHS re0
OS: FreeBSD 15.0-STABLE
OpenVPN version: 2.7.1
I'm running an OpenVPN client from my home broadband. I need to forward DNS resolution to my home broadband provider, however they only allow their own client networks to query their DNS resolvers. Therefore, I need to ensure that this traffic doesn't go through the OpenVPN tunnel but stays on the broadband.
Easy enough to configure:
Given
the result is wrong however:
Clearly visible that the IPv4 case is correct (and I have verified it works) but the IPv6 case points to the tunnel (tun0) instead of the broadband (re0) interface.
There's been some discussion around this years ago. However the patch provided (applies to OpenVPN 2.6) had not been committed apparently, and is also not committed to 2.7. I have modified this patch slightly so that it applies cleanly to 2.7.1, see patch.patch. With the patch applied, the result is correct:
OS: FreeBSD 15.0-STABLE
OpenVPN version: 2.7.1