On Sat, Jan 7, 2023 at 11:12 AM Gert Doering <g...@greenie.muc.de> wrote:
>
>
> > Though I vaguely understand why we set the address with /128 and then set
> > the route for the vpn subnet with fe80::8 as the gateway for
> tap-windows6,
> > wonder why we do this for dco as well.
>
> Let me recap why we do this for tap-windows - for windows, this is always
> an Ethernet adapter, so it wants to always do neighbour discovery (ND),
> IPv6's equivalent of ARP for all "on this interface" addresses.
>
> For "--dev tun" setups, OpenVPN does not want to deal with "Ethernet
> things",
> so the TAP driver replies to ARP requests for "special addresses" - for
> net30, OpenVPN ioctl()'s the "peer" address (which is also the gateway
> address) into the TAP driver, and only this address is replied to -
> admittedly, I do not know how "topology subnet" works wrt virtual ARP,
> need to read up on this again.
>
> For IPv6, I decided that having to deal with ND is easier if I could just
> look at a magic number, namely fe80::8, in the tap driver code - so, we
> use /128 for the ifconfig bit ("no network here, everything is behind the
> gateway") and point all routing to "on this interface, fe80::8" - so for
> whatever IPv6 destination, windows will only do ND for fe80::8, and the
> TAP driver will reply to it, without any further help (ioctl()) from
> OpenVPN.
>
Thanks for the explanation. I had a vague idea that this is done for ND.
>
>
> This said, I have no idea why we do it that way for wintun and DCO -
> most likely because it avoids having to add even more windows-driver-
> specific special case handling in places where we are nicely generic
> today.
>
I guess it works because nexthop is ignored[*] for tun adapters and we
could have just set an onlink route omitting the gateway parameter.
Selva
[*] Any bogus gateway seems to work, but still, "netsh int ipv6 show
neighbours"
lists any such gateway set for dco as initially "Probe" and then
"Unreachable",
so not totally ignored?
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
