The iroute option does not work quite correctly
Description of problem:
The iroute option does not work quite correctly, at least not in the way it is described. The routes described through iroute should become visible to all customers, except the one who serves this route. In reality, the route is also transmitted to the client for whom it is local.
- '# When set to true, all client's iroutes are made visible to all'
- '# connecting clients except for the ones offering them. This option'
- '# only makes sense if config-per-user is set.'
- '#expose-iroutes = true'
As a result, when using Openvpn Openconnect, the client, for which the route is local, reassigns it to itself as accessible via VPN connection and the local connection stops working.
The problem is solved by adding the -removeall option to the configuration file of the client that serves the route
Version of ocserv used:
1.30
Client used:
OpenWRT / openconnect 9.12-4
Distributor of ocserv
EPEL
How reproducible:
Describe the steps to reproduce the issue:
- uncomment option #expose-iroutes = true
- uncomment option #config-per-user = /etc/ocserv/config-per-user/
- add option iroute = somenetwork (10.10.10.0 f.e)/ somemask (24 f.e) into client configuration file /etc/ocserv/config-per-user/user1 (for example)
- restart openconnect service
- reconnect clients
Actual results:
all clients will receive the route 10.10.10.0/24 including user1, for whom it is local, user1 will lose connection to the network 10.10.10.0 as a result the route does not work for anyone including user1
Expected results:
all clients except user1 will receive the route 10.10.10.0/24, user1 will not receive the route 10.10.10.0/24 and its connection to this network will not be disrupted. All clients will be able to connect to the subnet 10.10.10.0, as described in the site-to-site recipe https://gitlab.com/openconnect/recipes/-/blob/master/docs/ocserv-site-to-site.md