Bypass over a VPN server is broken for custom providers (stale config launched, iproute mechanism inert on netlink builds) #75

New issue

Closed

opened 2026-08-19 20:32:05 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-19 20:32:05 -04:00

Owner

Found live 2026-08-19 during #68 validation: a bypass-over-VPN session with a custom provider connects but creates no tun_aqomui_b, installs nothing into table 11, and bypassed apps keep egressing via the physical link.

Two stacked defects:

The wrong config gets launched. write_config redirects edit to "bypass" internally for a bypass dict and writes bypass.ovpn (device name, route-up, table-11 plumbing) -- but openvpn()'s custom-provider branch then overwrites path to <provider>/temp.ovpn, the stale file from the last main connect of that provider. The bypass OpenVPN runs a copy of the main config: wrong device name (collides with a running main tunnel -- first-attempt failures), no route-up, no bypass routing. Supported providers set the bypass path upfront and are unaffected; custom+bypass was simply never exercised.
The table-11 mechanism assumes the iproute2 backend. bypass.ovpn steers routes via iproute scripts/bypass_route.sh, but this build uses the netlink backend (net_iface_up:/net_addr_v4_add: in the log), which never calls the iproute script -- so even the correct config would have installed the bypass tunnel's pushed redirect-gateway into the main table, hijacking all traffic. 2019-era mechanism, silently inert since the packaging moved off --enable-iproute2.

Fix: launch bypass.ovpn for custom-provider bypass dicts; replace the iproute redirect with route-noexec (install no pushed routes; route-up = bypass_up.sh gets $route_vpn_gateway/$dev either way and installs the single default into table 11). scripts/bypass_route.sh becomes dead and is removed.

Found live 2026-08-19 during #68 validation: a bypass-over-VPN session with a **custom provider** connects but creates no `tun_aqomui_b`, installs nothing into table 11, and bypassed apps keep egressing via the physical link. Two stacked defects: 1. **The wrong config gets launched.** `write_config` redirects `edit` to "bypass" internally for a bypass dict and writes `bypass.ovpn` (device name, `route-up`, table-11 plumbing) -- but `openvpn()`'s custom-provider branch then overwrites `path` to `<provider>/temp.ovpn`, the stale file from the last **main** connect of that provider. The bypass OpenVPN runs a copy of the main config: wrong device name (collides with a running main tunnel -- first-attempt failures), no route-up, no bypass routing. Supported providers set the bypass path upfront and are unaffected; custom+bypass was simply never exercised. 2. **The table-11 mechanism assumes the iproute2 backend.** `bypass.ovpn` steers routes via `iproute scripts/bypass_route.sh`, but this build uses the netlink backend (`net_iface_up:`/`net_addr_v4_add:` in the log), which never calls the iproute script -- so even the correct config would have installed the bypass tunnel's pushed `redirect-gateway` into the **main** table, hijacking all traffic. 2019-era mechanism, silently inert since the packaging moved off --enable-iproute2. Fix: launch `bypass.ovpn` for custom-provider bypass dicts; replace the `iproute` redirect with `route-noexec` (install no pushed routes; `route-up` = `bypass_up.sh` gets \$route_vpn_gateway/\$dev either way and installs the single default into table 11). `scripts/bypass_route.sh` becomes dead and is removed.

mysticalsoap referenced this issue from a commit

2026-08-19 20:34:53 -04:00

fix: launch the bypass config for custom providers, stop installing its pushed routes

mysticalsoap referenced this issue

2026-08-19 20:35:14 -04:00

fix: launch the bypass config for custom providers, stop installing its pushed routes #76

mysticalsoap referenced this issue from a commit

2026-08-19 20:44:23 -04:00

fix: launch the bypass config for custom providers, stop installing its pushed routes

mysticalsoap referenced this issue from a commit

2026-08-19 21:10:48 -04:00

fix: launch the bypass config for custom providers, stop installing its pushed routes