Page MenuHomeVyOS Platform

OpenVPN: first client subnet is not routed until the server is restarted
Open, HighPublicBUG

Description

T6478 skips the restart when only server client entries change, assuming OpenVPN reads client-config-dir at connect time. But server.conf.j2 renders client-config-dir only once a server client exists, so the first entry adds the directive while _only_client_config_changed() still returns True and apply() skips reload-or-restart. The running daemon doesn't read the CCD directory.

Steps:

  1. OpenVPN server with no server client entries and a connected client.
  2. set interfaces openvpn vtun10 server client <cn> subnet 10.77.0.0/24, commit.
  3. Reconnect the client.

The daemon keeps its PID; on reconnect there is no OPTIONS IMPORT, no iroute, and the client subnet is unreachable (with DCO, no kernel route either):

pid=12062 same-process=yes ccd-in-render=1 iroute-in-ccd-file=1 reload-or-restart-lines-since-commit=0
ping 10.77.0.1: 3 packets transmitted, 0 received, 100% packet loss

After restart openvpn interface vtun10 it works.

Impact: subnets behind OpenVPN clients stay unreachable after the first client entry until the daemon restarts for another reason.

Suggested fix: in _only_client_config_changed(), return False when the rendered server config changes, not only the CCD files.

Details

Version
1.4.5, 1.5.1, 1.5-rolling-20261026
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)