Presented routes are not implemented about openfortivpn

[lkundrak]

Yeah, that's because we don't parse /remote/fortisslvpn or /remote/fortisslvpn_xml yet. :(

[lkundrak]

Please let me know if https://github.com/lkundrak/openfortivpn/tree/split-vpn works for you.

[jjamor]

Hi @lkundrak just compiled and tested. Offered routes apparently ignored...

Using FortiOS 4.0 MR3 Patch 12.

A sample session with debug flag (connect and then CTRL-C for disconnect):

sudo openfortivpn -vvv
DEBUG:  Loaded config file "/etc/openfortivpn/config".
VPN account password: 
DEBUG:  Config host = "mygateway"
DEBUG:  Config port = "443"
DEBUG:  Config username = "myuser"
DEBUG:  Config password = "********"
DEBUG:  Gateway certificate validation failed.
DEBUG:  Gateway certificate digest found in white list.
INFO:   Connected to gateway.
INFO:   Authenticated.
DEBUG:  Cookie: SVPNCOOKIE=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
INFO:   Remote gateway has allocated a VPN.
DEBUG:  Gateway certificate validation failed.
DEBUG:  Gateway certificate digest found in white list.
WARN:   No gateway address
DEBUG:  ssl_write_thread
DEBUG:  ssl_read_thread
DEBUG:  pppd_read_thread
DEBUG:  if_config thread
DEBUG:  pppd ---> gateway (16 bytes)
...

...
INFO:   Got addresses: [172.29.1.66], ns [172.29.0.20, 172.29.0.29]
...
INFO:   Got addresses: [172.29.1.66], ns [172.29.0.20, 172.29.0.29]
...

INFO:   Got addresses: [172.29.1.66], ns [172.29.0.20, 172.29.0.29]
...
DEBUG:  if_config: not ready yet...

INFO:   Interface ppp0 is UP.
INFO:   Setting new routes...
DEBUG:  ip route show to 0.0.0.0/0.0.0.0
DEBUG:  Setting route to tunnel gateway...
DEBUG:  ip route add to MyGatewayIP/255.255.255.255 via 172.16.34.1 dev wlan0
DEBUG:  Deleting the current default route...
DEBUG:  ip route del to 0.0.0.0/0.0.0.0 via 172.16.34.1 dev wlan0
DEBUG:  Setting new default route...
DEBUG:  ip route add to 0.0.0.0/0.0.0.0 dev ppp0
INFO:   Adding VPN nameservers...
DEBUG:  Adding "nameserver 172.29.0.20" and "nameserver 172.29.0.29" to /etc/resolv.conf.
INFO:   Tunnel is up and running.
...

^CINFO:   Cancelling threads...
INFO:   Setting ppp interface down.
INFO:   Restoring routes...
DEBUG:  ip route del to 0.0.0.0/0.0.0.0 dev ppp0
DEBUG:  ip route add to 0.0.0.0/0.0.0.0 via 172.16.34.1 dev wlan0
DEBUG:  ip route del to 213.0.127.210/255.255.255.255 via 172.16.34.1 dev wlan0
INFO:   Removing VPN nameservers...
DEBUG:  Deleting "nameserver 172.29.0.20" from /etc/resolv.conf.
DEBUG:  Deleting "nameserver 172.29.0.20" from /etc/resolv.conf.
DEBUG:  Waiting for pppd to exit...
INFO:   Terminated pppd.
INFO:   Closed connection to gateway.
DEBUG:  Gateway certificate validation failed.
DEBUG:  Gateway certificate digest found in white list.
INFO:   Logged out.

[lkundrak]

Okay, so FortiOS 4 probably doesn't export the routes via /remote/fortisslvpn_xml resource and uses /remote/fortisslvpn only. Needs some more work.

[lkundrak]

Another try: could you please see if the branch https://github.com/lkundrak/openfortivpn/tree/split-vpn-4 works for you? No FortiOS installation around I can test against, so I used a mockup.

[jjamor]

@lkundrak excellent! This branch works! Good job!

...
INFO:   Interface ppp0 is UP.
INFO:   Setting new routes...
DEBUG:  ip route add to 192.168.8.0/255.255.255.0 via 172.29.1.66 dev ppp0
DEBUG:  ip route add to 192.168.9.0/255.255.255.0 via 172.29.1.66 dev ppp0
DEBUG:  ip route add to 192.168.4.0/255.255.255.0 via 172.29.1.66 dev ppp0
DEBUG:  ip route add to 172.29.0.0/255.255.0.0 via 172.29.1.66 dev ppp0
DEBUG:  ip route add to 172.29.1.64/255.255.255.224 via 172.29.1.66 dev ppp0
INFO:   Adding VPN nameservers...
DEBUG:  Adding "nameserver 172.29.0.20" and "nameserver 172.29.0.29" to /etc/resolv.conf.
INFO:   Tunnel is up and running.
...

Many thanks!

[jjamor]

Verified in upstream adrienverge/openfortivpn

Many thanks!