Bug 490437

Is your intention to have your VPN *always* be the default route when it's active?  If so, your VPN server is probably sending static routes back to NM on connect, and NM assumes that means that the VPN should only be active for those routes (otherwise, why would the server send the routes, which are redundant if the VPN was the default route?).

To make the VPN always be the default route, check the "Ignore automatically obtained routes" box in the Routes dialog.  To get there, open up the connection editor by right-clicking on the applet's icon and selecting "Edit connections...", click the VPN tab, edit your connection, click the IPv4 tab in the connection's window, and then the "Routes..." button in that tab.

Let me know (by reopening the bug) if that doesn't do what you want, or if I've mis-understood what you're trying to do here.

I did clicked 'Ignore automatically
obtained routes' - 

I do not get a default route -  With or without clicking that option.

This would be solved if the gui applet did not filter out 0.0.0.0 mask 0.0.0.0.

Thanks

gene

Ok, re-opening.  Which VPN service is this with, PPTP, vpnc, or openvpn?  Can you paste in the output of '/sbin/route -n' after making the connection, when the problem occurs?

This is with vpnc.

 I am not on premises at the moment which is where this occurs. 

 I connect a wifi connection first - and then use vpnc (to cisco backend).

 I had put in by hand (in nm-applet) 3 routes which I had left in. The routes I got in the end included a host route (from the wireless connection) along with the 3 routes I added - i put in address and netmask - the routes created from those I put in were simply to dev tun0.

 The 3 routes I put in cover a good chunk of my needs, but not all - hence the need for a default route.

  Is this sufficient or do you need more ?

 Mild obfuscation of IP addresses - here's the routes I get.

wifi connected (wlan0 ip aaa.27.146.24)
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
aaa.27.144.0    0.0.0.0         255.255.252.0   U         0 0          0 wlan0

Vpn connected (tun0 ip bbb.168.93.2 )
bbb.168.93.0    0.0.0.0         255.255.255.0   U         0 0          0 tun0
aaa.27.144.0    0.0.0.0         255.255.252.0   U         0 0          0 wlan0
ccc.168.128.0   0.0.0.0         255.255.128.0   U         0 0          0 tun0
ddd.107.0.0     0.0.0.0         255.255.0.0     U         0 0          0 tun0
bbb.168.0.0     0.0.0.0         255.255.0.0     U         0 0          0 tun0


The 3 routes I added in nm-applet re the last 3 rows

By hand I do this to make things work after the vpn is connected.

ip ro add default dev tun0

To get the VPN being the default, you *do not* want to enter static routes in nm-connection-editor.  You want "Use this connection only for resources on its network" *unchecked*, and "Ignore automatically provided routes" *checked*.  Using this configuration, I get:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
aa.bb.cc.dd     10.16.15.254    255.255.255.255 UGH   0      0        0 eth2
10.16.10.0      0.0.0.0         255.255.254.0   U     0      0        0 tun0
10.16.12.0      0.0.0.0         255.255.252.0   U     2      0        0 eth2
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 tun0


and as expected, the default route is through the VPN.  By unchecking "Ignore automatically provided routes" in nm-connection-editor, the VPN is no longer the default route (as expected), and only the server-provided routes are VPN-enabled.

Please confirm that removing any manually specified routes, checking "Ignore..." and unchecking "Use this connection..." makes the VPN the default route for you.

Thanks for thought - sorry to be slow in respondning have been unable to do this till now.

Doing what you said

  o Deleted all static routes
  o uncheck 'Use only for ...
  o check 'ignore automatically provided ..'

I do NOT get a default route i get this:

# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
bbb.168.93.0    0.0.0.0         255.255.255.0   U         0 0          0 tun0
aaa.27.144.0    0.0.0.0         255.255.252.0   U         0 0          0 wlan0


As an aside - is there any reason to disallow entering a default route in the applet - since you can add routes anyway ?

If it matters - the wifi connection is a hidden one (not my choice).

thanks for help ... may I please again to allow adding a default route anyway, regardless of buttons to click ?

thanks again.

to be clear - above route info is in the vpn part of applet - the wireless part has nothing set for routes - no static routes and neither button is clicked.

Update - problem persists :

 NetworkManager-0.7.1-4.git20090414.fc11.x86_64
 NetworkManager-vpnc.x86_64         1:0.7.0.99-1.fc11             installed      
 vpnc.x86_64                        0.5.3-3.fc11                  installed

The problem persists on F11 and it is not just VPN stuff.

If you have only a single NIC, then there is only one possible default route and everything works.

If you have a system (such as a laptop) with both a wired and a wireless NIC, then everything works because only on will be active and any point in time (as controlled by NetworkManager).

However, if you have two or more NICs (real or pseudo), then things get screwed up and the last interface enabled will set the default route.

In my case, I have a qemu-kvm guest with two NICs.  The first NIC (eth0) can either be a bridged connection (on br0) or a NATed connection (on virbr0) the default route needs to point to this interface.  The second NIC (eth1) is connected to a private ("host-only") network on virbr2..

I have tried setting both GATEWAY=<ip_addr> and GATEWAYDEV=<device> and neither has any effect.

In the QEMU case, or in any case where you have multiple devices, there solution is slightly different for system and user connections.  First a short explanation of system and user connections...

system connections are stored in ifcfg files and are the normal ifcfg network files you've probably used before.  They are available to be used by NM before login and at system boot time, and by an user on the machine.

User connections are private to each user and are not available to other users, and their configuration is stored in GConf in the user's session.  They are only available when that user is logged in.

So it depends right now on what type of connection it is.  If the connection is stored in an ifcfg file, then GATEWAYDEV is the method you should use to ensure that the default route is via the device of your choice.  If it's a user connection, then you want to check the "Use this connection only for resources on its network" for the connections you do *not* want to ever have the default route.

So if you have 2 NICs and a VPN connection, and you want only eth0 and the VPN to get the default route, you would set GATEWAYDEV=eth0 and ensure the "Only use this connection for resources on its network" box is *un*checked.  Thus eth1 would never receive the default route, but eth0 would, and when the VPN was active, tun0 would have the default route.

Does that clear things up at all?  If not, can you tell me what connections you see in the 'wired' page of nm-connection-editor (right-click on the applet, choose Edit connections...) so that we can track down how you need to configure the default route?  What files do you have in /etc/sysconfig/network-scripts/ifcfg-* ?

Thanks!

Should we dupe this bug to bug #528281 ?

Yes, I believe that this is a dup ... the patch to add DEFROUTE= should solve this user's problem.

*** This bug has been marked as a duplicate of bug 528281 ***