Dear Maintainer,

Differently from VPN-connections established from console via sudo openvpn,
the
ones established via Network Manager have lower priority than the wired
connection. This leads to VPN-connections established via Network Manager
not
being used.

To illustrate that, here are the listings of my routes without VPN, with a
VPN-
connection established via Network Manager and with a VPN-connection
established via sudo openvpn:

eugrus@eugensdebianpc:~$ ip route # without VPN
default via 192.168.178.1 dev enp0s25
default via 192.168.178.1 dev enp0s25 proto dhcp src 192.168.178.25 metric
100
10.0.3.0/24 dev lxcbr0 proto kernel scope link src 10.0.3.1 linkdown
169.254.0.0/16 dev enp0s25 scope link metric 1000
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.25
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.25
metric
100
192.168.178.1 dev enp0s25 scope link
eugrus@eugensdebianpc:~$ ip route # VPN established from Network Manager
default via 192.168.178.1 dev enp0s25
default via 10.8.0.1 dev tun0 proto static metric 50
default via 192.168.178.1 dev enp0s25 proto dhcp src 192.168.178.25 metric
100
10.0.3.0/24 dev lxcbr0 proto kernel scope link src 10.0.3.1 linkdown
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2 metric 50
94.198.134.88 via 192.168.178.1 dev enp0s25 proto static metric 50
169.254.0.0/16 dev enp0s25 scope link metric 1000
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.25
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.25
metric
100
192.168.178.1 dev enp0s25 scope link
192.168.178.1 dev enp0s25 proto static scope link metric 50
eugrus@eugensdebianpc:~$ ip route # VPN established with sudo openvpn
0.0.0.0/1 via 10.8.0.1 dev tun0
default via 192.168.178.1 dev enp0s25
default via 192.168.178.1 dev enp0s25 proto dhcp src 192.168.178.25 metric
100
10.0.3.0/24 dev lxcbr0 proto kernel scope link src 10.0.3.1 linkdown
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2
94.198.134.88 via 192.168.178.1 dev enp0s25
128.0.0.0/1 via 10.8.0.1 dev tun0
169.254.0.0/16 dev enp0s25 scope link metric 1000
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.25
192.168.178.0/24 dev enp0s25 proto kernel scope link src 192.168.178.25
metric
100
192.168.178.1 dev enp0s25 scope link

Kind regards,
Evgeny Fishgalov

Where exactly is the problem?
Please highlight it explicitly.
Please also share your NM configuration for the openvpn connection.

Am 17.03.2024 um 18:18 schrieb Evgeny Fishgalov:

The problem is that when connected to VPN via Network Manager

a) I can't access the resources of the remote local network;

b) the traffic does not get tunneled over VPN routes.


This problem doesn't appear when connected via sudo openvpn


Here are (anonymised) contents of the .nmconnection file for my VPN
connection in /etc/NetworkManager/system-connections

[connection]
id=korolev
uuid=ANONYMISED-UUID
type=vpn
autoconnect=false

[vpn]
auth=SHA256
ca=/home/eugrus/.cert/nm-openvpn/korolev-ca.pem
cert=/home/eugrus/.cert/nm-openvpn/korolev-cert.pem
cert-pass-flags=0
cipher=AES-128-GCM
connection-type=tls
dev=tun
key=/home/eugrus/.cert/nm-openvpn/korolev-key.pem
remote=ANONYMISED.IP:1194
remote-cert-tls=server
tls-cipher=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
tls-crypt=/home/eugrus/.cert/nm-openvpn/korolev-tls-crypt.pem
tls-version-min=1.2
verify-x509-name=name:server_ANONYMISED
service-type=org.freedesktop.NetworkManager.openvpn

[ipv4]
may-fail=false
method=auto

[ipv6]
addr-gen-mode=stable-privacy
may-fail=false
method=auto

[proxy]

This default route does not have any metric attached which makes me
wonder if it was actually created by network-manager?

Do you by any chance use another tool like ifupdown to manage enp0s25 ?

As with the original poster I have the same issue. All openvpn connections
are ignored since the upgrade to network-manager1.42.4-1

Am 13.11.25 um 15:39 schrieb Mark Dickie:

I'm still waiting for an answer to
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067052#22