Join Log in
Score:0
Vitor Falcão avatar Server

VPN deleting routes from another

cn flag
Vitor Falcão

When I connect to first VPN (utun4) and I run the command ip route, this is the output I get:

10.10.0.0/16 via 172.27.232.1 dev utun4
10.100.0.0/16 via 172.27.232.1 dev utun4
10.250.152.0/21 via 172.27.232.1 dev utun4
172.27.224.0/20 via 172.27.232.1 dev utun4
172.27.232.0/21 via 172.27.232.29 dev utun4
172.27.232.1/32 via 172.27.232.29 dev utun4

But when I connect to the second one (utun3), it deletes all 10.x.x.x entries for utun4:

default via link#19 dev utun3
9.49.252.128/27 via 10.38.110.180 dev utun3
9.57.162.0/24 via 10.38.110.180 dev utun3
9.187.76.0/27 via 10.38.110.180 dev utun3
9.187.76.128/25 via 10.38.110.180 dev utun3
10.0.0.0/8 via 10.38.110.180 dev utun3
10.38.0.101/32 via 10.38.110.180 dev utun3
10.38.96.0/20 dev utun3  scope link
10.64.0.111/32 via 10.38.110.180 dev utun3
10.250.152.2/32 via 172.27.232.1 dev utun4
18.214.230.18/32 via 10.38.110.180 dev utun3
34.231.46.80/32 via 10.38.110.180 dev utun3
50.17.199.7/32 via 10.38.110.180 dev utun3
52.202.191.19/32 via 10.38.110.180 dev utun3
52.206.134.40/32 via 10.38.110.180 dev utun3
54.197.131.158/32 via 10.38.110.180 dev utun3
64.26.251.136/30 via 10.38.110.180 dev utun3
64.26.251.192/26 via 10.38.110.180 dev utun3
64.26.255.0/25 via 10.38.110.180 dev utun3
72.163.1.80/32 via 10.38.110.180 dev utun3
100.64.0.0/11 via 10.38.110.180 dev utun3
144.188.129.17/32 via 10.38.110.180 dev utun3
172.22.0.0/16 via 10.38.110.180 dev utun3
172.23.0.0/16 via 10.38.110.180 dev utun3
172.24.0.0/16 via 10.38.110.180 dev utun3
172.27.224.0/20 via 172.27.232.1 dev utun4
172.27.232.0/21 via 172.27.232.29 dev utun4
172.27.232.1/32 via 172.27.232.29 dev utun4
224.0.0.0/4 dev utun3  scope link
255.255.255.255/32 dev utun3  scope link

Output for ip r | grep utun4:

10.250.152.2/32 via 172.27.232.1 dev utun4
172.27.224.0/20 via 172.27.232.1 dev utun4
172.27.232.0/21 via 172.27.232.29 dev utun4
172.27.232.1/32 via 172.27.232.29 dev utun4

Only 10.250.152.2/32 remains, and I believe it's because it's as specific as it could. Why does it happen? How can I prioritize utun4? I am using MacOS.

61
0 + 0
vpn
Nikita Kipriyanov avatar
za flag
Nikita Kipriyanov
Which VPN software is this? NB: this is precise reason why the routes installed by the VPN should be as narrow as possible.
0
Reply
Vitor Falcão avatar
cn flag
Vitor Falcão
@NikitaKipriyanov OpenVPN and AnyConnect, AnyConnect is the one creating utun3
0
Reply
Score:1
avatar Server
it flag
montjoy

Not 100% on this, but I see your second VPN has the network/route: 10.0.0.0/8 via 10.38.110.180 dev utun3

That's a bit wonky because it covers the same range as these on utun4: 10.10.0.0/16 via 172.27.232.1 dev utun4 10.100.0.0/16 via 172.27.232.1 dev utun4 10.250.152.0/21 via 172.27.232.1 dev utun4

I don't know how your VPN software handles it but it may just be removing routes/subnets that were previously defined if the new routes overlap.

Try to be more specific instead of using the 10.0.0.0/8. Just to test, you could remove just that one route to see if it helps or not.

You could also try adding metrics to your routes to tell your client which route to prefer.

One last idea - some VPNs are very strict on the routes they allow their clients to have. I'd check for that too.

0 + 0
Vitor Falcão avatar
cn flag
Vitor Falcão
I am starting to believe it's about one of the VPNs behavior. It's a MacOS so no metrics on the routes, it just prioritizes devices. I am thinking about building something to deal with overlapping VPNs...
0
Reply
it flag
montjoy
@Horus I see from the other comment that you are using AnyConnect. From my experience AnyConnect really really wants to be in charge of your routes when it's active - usually for good security reasons.
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.