OpenVPN 2.7 tun detection and bypass routing on modern iproute2 #61
Loading…
Reference in a new issue
No description provided.
Delete branch "mysticalsoap/fix/openvpn27-tun-and-bypass-route"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Live-testing #58 surfaced three inherited bugs, found via one service log. Together they made the bypass silently ineffective (a bypassed shell showed the VPN's egress IP) and froze the status widget at "Uptime: 01s" with no traffic stats.
TUN/TAP device, but 2.7 with DCO printsDCO device tun0 opened/ovpn-dco device [tun0] opened— and 2.7 also switched to ISO log timestamps, which broke the oldasctime-strip + position-based split even for the classic message.self.tunstayedNone: no per-link DNS (DNS: systemd-resolved is active and no interface was given), and the frozen status widget (TunnelMondies on its first stat read of a nonexistent interface).create_cgroupadded the sameip ruletwice; iproute2 now refuses an exact-duplicate rule ("File exists"), the exception aborts the block, and the default route never lands in table 11 — marked packets fall through to main and out the tunnel. Duplicate copies also accumulated across reconnects because deletion removed only one (and never the v6 rule at all).return_tun_devicecrashed onNone— a's'-signature D-Bus method can't marshal it (Unable to append (None,)in the log), so the GUI got an error instead of an answer.Fix
tunnel.parse_tun_device(): regex over the raw line matching all three announcement forms, timestamp-format agnosticbypass.clear_fwmark_rules(ip6=...): deletes every copy of the fwmark rule, called before the now-singleip rule addincreate_cgroup, indelete_cgroup(which gains the previously-missing v6 cleanup), and in the WireGuard reconnect block; the v6 log lines also stop printing the v4 gatewayreturn_tun_devicereturns""when no device is setVerification
clear_fwmark_rulesdeletes until none remain and addresses the right stack (57 pass)ip ruleshows exactly one fwmark rule;ip route show table 11has the physical default route;curl icanhazip.comfrom a bypassed shell prints the home IPRelated fixes: found while live-testing #58; with routing fixed, the DNS path verified there becomes effective end to end.
Assisted-by: claude-fable-5
33d905974fd62a50a45a