Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve routing loops detection #699

Open
lstipakov opened this issue Mar 6, 2025 · 0 comments
Open

Improve routing loops detection #699

lstipakov opened this issue Mar 6, 2025 · 0 comments
Assignees
@lstipakov

Comments

@lstipakov
Copy link
Member

At moment we drop all tun packets with the same destination as VPN server, since we assume them originating from openvpn and we want to avoid routing loop. This might backfire in case of more complex routing rules. Let's use more fine-grained approach - drop packet if all following criteria are met:

  • packet IP family matches transport IP family
  • packet protocol (UDP/TCP) matches transport protocol
  • packet destination address matches transport address
  • packet destination port matches transport port
@lstipakov lstipakov self-assigned this Mar 6, 2025
lstipakov added a commit to lstipakov/openvpn that referenced this issue Mar 6, 2025
@lstipakov
Make recursive routing check more fine-grained
6c2f192 
The existing recursive routing check drops TUN packets
if their address matches the remote. While this works in
most cases, a more fine-grained check is preferable for
complex routing rules.

Since we only need to drop traffic originating from OpenVPN,
all of the following values must match between the packet
and the link:

 - IP protocol
 - Transport protocol (TCP/UDP)
 - Destination address
 - Destination port

GitHub: OpenVPN#699

Change-Id: I6841e2f2a85275254a04e2d8ae3defe4420db8f6
Signed-off-by: Lev Stipakov <[email protected]>
lstipakov added a commit to lstipakov/openvpn that referenced this issue Mar 6, 2025
@lstipakov
Make recursive routing check more fine-grained
9e001ea 
The existing recursive routing check drops TUN packets
if their address matches the remote. While this works in
most cases, a more fine-grained check is preferable for
complex routing rules.

Since we only need to drop traffic originating from OpenVPN,
all of the following values must match between the packet
and the link:

 - IP protocol
 - Transport protocol (TCP/UDP)
 - Destination address
 - Destination port

GitHub: OpenVPN#699

Change-Id: I6841e2f2a85275254a04e2d8ae3defe4420db8f6
Signed-off-by: Lev Stipakov <[email protected]>
lstipakov added a commit to lstipakov/openvpn that referenced this issue Mar 6, 2025
@lstipakov
Make recursive routing check more fine-grained
6f77a6b 
The existing recursive routing check drops TUN packets
if their address matches the remote. While this works in
most cases, a more fine-grained check is preferable for
complex routing rules.

Since we only need to drop traffic originating from OpenVPN,
all of the following values must match between the packet
and the link:

 - IP protocol
 - Transport protocol (TCP/UDP)
 - Destination address
 - Destination port

GitHub: OpenVPN#699

Change-Id: I6841e2f2a85275254a04e2d8ae3defe4420db8f6
Signed-off-by: Lev Stipakov <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lstipakov lstipakov

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@lstipakov