Title: OpenVPN as the default gateway on OpenBSD Author: Solène Date: 27 October 2020 Tags: openbsd openvpn Description: If you plan to use an OpenVPN tunnel to reach your default gateway, which would make the tun interface in the `egress` group, and use `tun0` in your `pf.conf` which is loaded before OpenVPN starts? Here are the few tips I use to solve the problems. ## Remove your current default gateway We don't want a default gateway on the system. You need to know the remote address of the VPN server. If you have a `/etc/mygate` file, remove it. The `/etc/hostname.if` file (with if being your interface name, like em0 for example), should look like this: 192.168.1.200 up !route add -host A.B.C.D 192.168.1.254 + First line is the IP on my lan + Second line is to make the interface up. + Third line is means you want to reach `A.B.C.D` via `192.168.1.254`, with the IP `A.B.C.D` being the remote VPN server. ## Create the tun0 interface at boot Create a `/etc/hostname.tun0` file with only `up` as content, that will create `tun0` at boot and make it available to `pf.conf` and you prevent it from loading the configuration. You may think one could use "egress" instead of the interface name, but this is not allowed in queuing. ## Don't let OpenVPN manage the route Don't use `redirect-gateway def1 bypass-dhcp` from the OpenVPN configuration, this will create a route which is not `default` and so the tun0 interface won't be in the egress group, which is not something we want. Add those two lines in your configuration file, to execute a script once the tunnel is established, in which we will make the default route. script-security 2 up /etc/openvpn/script_up.sh In `/etc/openvpn/script_up.sh` you simply have to write #!/bin/sh /sbin/route add -net default X.Y.Z.A If you have IPv6 connectivity, you have to add this line: /sbin/route add -inet6 2000::/3 fe80::%tun0 (not sure it's 100% correct for IPv6 but it works fine for me! If it's wrong, please tell me how to make it better).