6

In exploring how my local openVPN virtual interface utun0 works, I came across the following data, and I don't know how to make sense of it. (I'm on a Mac)

$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.8.0.5           UGSc           61        0   utun0
default            192.168.7.254      UGSc            7        0     en0
10.8.0.1/32        10.8.0.5           UGSc            1        0   utun0
10.8.0.5           10.8.0.6           UHr           110       12   utun0
54.242.164.191/32  192.168.7.254      UGSc            2        0     en0
...

It looks like "0/1" is CIDR notation. Is that correct? If so, I have follow up questions. From my understanding, an interface is chosen according to which subnet(s) match the destination ip. With 0/1, only ip addresses whose first bit is 0 would match -- which means only ip address >= 128.0.0.0 would match. Is that true? I could believe that except then I get this

$ ip route get 8.8.8.8
8.8.8.8 via 10.8.0.5 dev utun0  src 10.8.0.6

So now I'm really confused what "0/1" means and why that route trumps the default route.

EDIT

0/1 would actually mean anything < 128.0.0.0, however, I still get this:

$ ip route get 198.41.208.137
198.41.208.137 via 10.8.0.5 dev utun0  src 10.8.0.6

So ip addresses both greater and lesser than 128.0.0.0 go through the router. How? Why?

I do see a 128/1 as well:

$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.8.0.5           UGSc           63        0   utun0
default            192.168.7.254      UGSc            5        0     en0
...
128.0/1            10.8.0.5           UGSc           42        0   utun0
...

So @Teun Vink seems to be correct.

  • What is the router model? – Ron Maupin Aug 29 '16 at 17:33
  • How did you do "ip route get 198.41.208.137" on a Mac? Or had you switched to a Linux box for that? I happen to be looking for a similar command for the Mac. – Marnix A. van Ammers Mar 3 at 20:07
  • It's very possible that I brew installed something to get that cli command. But I don't remember what if I did – Alexander Bird Mar 4 at 14:44
7

Some VPNs push the default gateway (a /0 netmask) as two /1 networks: 0/1 and 128/1. Since a more specific route always wins, this forces traffic to be routed via the VPN instead of over the default gateway.

  • What would happen if I have two VPN clients installed? I assume what would happen is that when I turn VPN 1 on, it would be fine, but when I turn VPN 2 on (assuming it also does the 0/1 128/1 trick), it would fail because those subnets are already in use. Does that sound right? – Alexander Bird Aug 29 '16 at 19:19
  • Assuming both VPNs push the same routes: yes, then you'd have two equal routes, so that wouldn't work as expected. – Teun Vink Aug 30 '16 at 5:07
1

The first bit is for the netmask not for the address, this route mean all IP starting from 0.0.0.0 with netmask 128.0.0.0 so Network: 0.0.0.0/1 0 0000000.00000000.00000000.00000000 HostMin: 0.0.0.1 0 0000000.00000000.00000000.00000001 HostMax: 127.255.255.254 0 1111111.11111111.11111111.11111110

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.