Just looking at this myself, it does indeed seem to be becuase the user is nobody (and possibly a chroot is also in effect).
One workaround would be to use the /usr/lib/openvpn/openvpn-down-root.so plugin to restore the gateway afterwards. However it would be _far_ preferable for openvpn to do this itself. Related to this is errors in the logs upon a down: 21:26:02 2006 /etc/openvpn/openvpn.up tun0 1500 1542 192.168.10.6 192.168.10.5 init 21:26:02 2006 /sbin/route add -net 192.168.11.0 netmask 255.255.255.0 gw 192.168.10.5 21:26:02 2006 /sbin/route add -net 192.168.10.1 netmask 255.255.255.2 55 gw 192.168.10.5 21:26:02 2006 GID set to nogroup 21:26:02 2006 UID set to nobody 21:26:02 2006 Initialization Sequence Completed (VPN up, hit Ctrl-C to take it down) 21:26:13 2006 event_wait : Interrupted system call (code=4) 21:26:13 2006 TCP/UDP: Closing socket 21:26:13 2006 /sbin/route del -net 192.168.10.1 netmask 255.255.255.255 SIOCDELRT: Operation not permitted 21:26:13 2006 ERROR: Linux route delete command failed: shell command exited with error status: 7 21:26:13 2006 /sbin/route del -net 192.168.11.0 netmask255.255.255.0 SIOCDELRT: Operation not permitted 21:26:13 2006 ERROR: Linux route delete command failed: shell command exited with error status: 7 21:26:13 2006 Closing TUN/TAP interface These errors don't actually cause a problem - presumably because Linux is dropping all the routes through the tun0 device anyway. However it _is_ a problem if you have a default gateway redirect because then it tries to add the old gateway back in and this fails. In fact, it will also be a problem for any routes that are deleted (e.g. if you have another route which is overridden for the duration of the VPN by a route push command). Adrian -- Email: [EMAIL PROTECTED] -*- GPG key available on public key servers Debian GNU/Linux - the maintainable distribution -*- www.debian.org Avoid working with children, animals and Microsoft "operating" systems -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
