dhcpcd clobbers OpenVPN routes

[ksool]

Hey all,

I've recently switched over to using resolvconf to keep my local djddns dns cache happy and things have been going fairly smoothly (thanks to uberlord). My one problem now though, is that when using openvpn on a dhcpcd connection, every so often my route to the vpn server will be removed as well as my dns information in resolvconf.

I've currently set dhcpcd to use the -N -R flags, and I've tried adjusting the requested lease times, but I can't get an infinite lease and the problem persists with anything else. I can't tell if this is a problem with dhcp rebinding/leasing or if I'm losing the dhcp connection and being forced to re-establish it.

Any ideas?

Also, on a perhaps relevant sidenote: I've been having trouble with the wireless init scripts and I don't know if its a script problem, a wpa_supplicant problem or a driver problem. When I call the init script, it generally times out, but then connects in the background. /var/log/messages looks like this: (I'm using bcm43xx but this seems to occur with ndiswrapper as well)

[UberLord]

Why are you using -R? that stops dhcpcd from updating dns information, which includes resolvconf ....
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

[ksool]

It was a weak attempt to prevent dhcpcd from rewriting to resolvconf every time it renewed it's lease or rebound. I set the dns servers (they're static) for this WLAN in /etc/conf.d/net.

I should note that this was done in response to dhcpcd overwriting the dns information I pushed to resolvconf through my openvpn up script, though it doesn't seem to work either way. I had used the -R option as the solution to this problem when I was managing my wireless through bash scripts prior to returning the resolvconf and the init scripts.

[UberLord]

Maybe you then need a decent local resolver that supports resolvconf. dnsmasq is a good choice and our Gentoo ebuild will install a script when USE=resolvconf
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

[ksool]

I've been using djbdns locally and it works well with resolvconf (in my experience). It is my understanding that the problem comes from dhcp repeatedly pushing dns info to resolvconf (it succeeds and works all the way through to djbdns) but in the in the process, overwrites the dns from the vpn. This occurs even using the -R switch; perhaps because I'm using the dns servers listed in /etc/conf.d/net (whereas it would ignore information passed to it from the dhcp server). I'd have no problem switching to dnsmasq but I don't think this will remedy the problem.

I think that the problem with the actual openvpn routes being removed is a separate problem since it occurs less frequently and for the time being, I'm chalking this up to a full dhcp re-establishment (adding its own routes and such).

[UberLord]

Oh, i see what it's doing now. Each is wanting to install a default route, both dhcpcd and openvpn. dhcpcd will get a metric as it's under baselayout control, but openvpn won't. That means that vpn routes will always be preferred over dhcpcd routes which could be quite bad. The solution is to push a metric from the openvpn server like so

push "route-metric 50000"
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

[ksool]

I gave this a try but couldn't get openvpn to set the metric's correctly. The server is running 2.0.6 and the client is 2.1_rc4-r2. The "route-metric 5000" option shows in the "PUSH: Received control message: ..." line but didn't take. Does ordering matter? I wouldn't think so. Anyway, I saw your patch on openvpn-devel but saw a reply that said it would be incorporated into 2.1 and I'm not getting the unrecognized option warning like I had with the client on 2.0.6. Anyway, I'll see if I can get that working.

Could you just take a quick second to explain why there is this problem. The only conflict I can see would be if dhcp tries to add a default route, but changing the openvpn metric would cause my machine to prefer the dhcp route instead of the route over the vpn. Perhaps dhcpcd needs the route over the local subnet briefly (hopefully removing it once it had finished) and this is being prevented by the vpn route's 0 metric. But then again, dhcpcd should only need to communicate with the dhcp server, so I could only see this being a problem when the dhcp server is on a different subnet, but I don't know if that's even possible. Anyway, I'm stumped.

[UberLord]

First you need to describe your network topology
Basically you only need route metrics if you have routes on the same subnet or more than 1 default route.
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool

[ksool]

Ok, that's what I'd thought. Basically, I have a home network with vpn server behind a router, and a vpn client that connects back home and uses the gateway over vpn, so there shouldn't be any conflict of routes.

Does resolvconf give any priority to information it's given, or does it just always take the last information it received? Also, I've setup my openvpn up script to replace the information on the same interface to which dhcpcd assigned. IE, dhcpcd gives resolvconf information about wlan0, and I have to use resolvconf to replace the wlan0 entry, rather than to add a tap0 entry (this doesn't update djbdns properly). Could this be the source of the problem?

[UberLord]

Possibly.

I write the bind and dnsmasq resolvconf scripts, and they are "special" in that all dns servers are global - except for the ones handed out by vpn.

So at work, I get a global of "development.work" and a vpn for "marples.name". So anything for "marples.name" goes to the vpn dns servers, otherwise the work servers.
At home, both global and vpn are for "marples.name" and the scripts are intelligent enough to send all traffic to the vpn name servers.

I don't know if the djbdns resolvconf script does that or even if djbnds supports that concept.
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool