VPN does not add network route

Installing and Using OpenWrt Network and Wireless Configuration
1

Using Openwrt 4.9.120

I have set up a pptp vpn to connect to another site, the link comes up and I can ping Internet sites and the vpn remote gateway, but not any hosts on the remote LAN. Basically, I want to set up a LAN-LAN vpn for traffic between the LANs and all other traffic to go the default local gw to Internet.

Local LAN: 192.168.11.0/24
Remote LAN: 192.168.1.0/24

`ip -o link show up` -->
...
11124: pptp-SCD_pptp01: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN qlen 3\    link/ppp

route -n gives

root@OpenWrt:~# route -n 
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.42.129  0.0.0.0         UG    0      0        0 usb0
11.22.33.44     192.168.42.129  255.255.255.255 UGH   0      0        0 usb0
192.168.1.1     0.0.0.0         255.255.255.255 UH    0      0        0 pptp01
192.168.11.0    0.0.0.0         255.255.255.0   U     0      0        0 br-lan
192.168.42.0    0.0.0.0         255.255.255.0   U     0      0        0 usb0
root@OpenWrt:~#

I can ping 192.168.1.1, but not any host on the 192.168.1.x LAN.

If I add the route manually with:
/sbin/route add -net 192.168.1.0/24 gw 192.168.1.1
all works as desired and expected.

Now, back to the LuCi vpn setup. What do I need to do to have the route added and deleted on this vpn link, in LuCi?

Or, is this a bug or deficiency?

1 Like
2

It is expected behavior.
The static routes that are bound to an interface will be erased when the interface goes down. You need to add this route with an if-up script, if there is no option in Luci.
It would be a better idea to leave pptp and go to Wireguard or Openvpn for site-to-site tunnels. Better security and you can automatically install routes.

1 Like
3

"expected behavior", no, it is a deficiency: a design deficiency; a not yet implemented issue; or a bug. Beta behavior at best.

So, lets move this to a design recommendation list.

pptp is another issue which will be remedied later, however; this is probably a common denominator issue for any vpn that is used. An option that needs to be implemented.

So, looks like a if-up script is the only answer to my question at this stage. Hopefully, that will be mainline implemented, as a basic route or based on policy-based routing in the future.

4

I am having to re-visit this problem, for a pptp vpn and later an ip-sec vpn, but for now the pptp. I have added logger line into scripts at various locations, including /etc/hotplug.d/iface/, /etc/ppp/ without getting any log events/messages.

So, when a pptp vpn is brought up (usually via LuCi) and at other times via uci; what file if the location to add a few lines of script code to set routes for the vpn?

I need to automate this as much as possible, as vpn code is not adding the appropriate network route. Thence, removing the network route on closing down the vpn.

5

https://openwrt.org/docs/guide-user/services/vpn/pptp/basic#network_configuration

1 Like
6

So we need the hotplug script in here .
But how to make the script
For event when pptp0 is up
route add -net 192.168.11.0/24 gw 192.168.1.1

I read some articles but I didn't get where and what exactly I have write

7

Do you need to add the route on the server or client side?

1 Like
8

I need to make both
On server
If ppp0 is up
then route add -net 192.168.200.0/24 gw 192.168.6.1(ppp0)

On client
If ppp0 is up route add -net 192.168.100.0
gw 192.168.6.2 (ppp0)

And forbid to make ppp0 default gateway

The question is what file to edit and what exactly
To write

1 Like
9
2 Likes
10

Thanks a lot but what is ${1} ${5}

Device is like ppp0 as I understand
and via is ip for gateway like pppo0 ip
And why for server it is hotplug script with
Ip route 2
And for client it is ip tables ?

1 Like
11

Client side interface is managed by netifd, since it supports the PPTP client protocol.
So, we can attach the route to the PPTP interface with native UCI syntax.

Server side interface is managed by pptpd.
Thus, we cannot rely on netifd, but need to use PPP scripts instead.

1 Like
12

There is another problem when first client connects it has ppp0 interface and the script make right gw for it ( I made server ppp interface like gw for 44.0/24 )
But the second interface connects and gets ppp1 interface with default route through wan
I need only one route for any numbers of clients
Because if client router lost power and then up it will get new interface new ip address and I need that route to (44.0/24) working for it

13

I modified the PPP script to support multiple clients and moved the code to the wiki.

2 Likes
14

But 192.168.6.2 is client IP
What if client changed its IP

15

Configure static address allocation on the server.
Or check the variable PEERNAME instead.

1 Like
16

There was ${1} and ${5} no there is ${IPREMOTE}
and ${IFNAME} arent these the same things ?

17

Yep, but it wasn't originally documented.
I updated the wiki only recently after testing the code.

1 Like
18

Good I understand that
Can do

case ${IPREMOTE} in
(192.168.6.2) ip route add 192.168.2.0/24 dev ${IFNAME} via ${IPREMOTE} ;;

case ${IPREMOTE} in
(192.168.6.3) ip route add 192.168.2.0/24 dev ${IFNAME} via ${IPREMOTE} ;;

esac

So any client connects they know the route to 2.0/24

19 
case ${IPREMOTE} in
(192.168.6.2|192.168.6.3) ... ;;
(192.168.6.[45]) ... ;;
(192.168.6.6) ... ;;
(*.6.7) ... ;;
(*.8) ... ;;
(*) ... ;;
esac
1 Like
20 
#!/bin/sh                                                                              
case ${IPREMOTE} in                                                                    
(192.168.27.20) ip route add 192.168.44.0/24 dev ${IFNAME} via ${IPREMOTE} ;;          
(192.168.27.21) ip route add 192.168.44.0/24 dev ${IFNAME} via ${IPREMOTE} ;;          
esac

Did like this didn't work
Only for first one route was created
Maybe it needs some metric parametr or something