openvpn and FRR OSPFv2 / OSPFv3

[r0000000m]

Hello,

Did anyone succed in using OSPFv2 (IPv4) inside an OpenVPN DCO tunnel ?
Did anyone succeed in using OSPFv3 (IPv6) inside an OpenVPN tunnel ? (with or without DCO)

Maybe someone has a good advice to help me get it work...

Here is my setup :
- server : openvpn 2.6.12-bookworm0 in debian LXC
- client instance : openvpn 2.6.12 on OPNsense 24.7.5-amd64 (instance is used, not legacy client)
- TLS vpn, no PSK

When I use TUN instead of DCO, OSPFv2 is working well.
When I turn DCO on then the OSPFv2 neighbor adjacency is not established so no routes are exchanged.
With DCO I can see using tcpdump on the openvpn interfaces that OSPFv2 hello packets (dst IP 224.0.0.5) are sent in the tunnel on the server side but don't arrive to the client openvpn interface.
On the other hand, OSPF packets which are sent on the client side arrive to the server openvpn interface.

Regarding OSPFv3 (IPv6) it's the same with and without DCO : hello packets (dst IP ff02::5) are sent on both sides, not received on any side.

OSPFv2 and OSPFv3 are working if I use a legacy client configuration. But I need an instance in order to use DCO.

I guess my FRR OSPFv2 / OSPFv3 configurations are correct since there's no problem with interfaces which are not openvpn interfaces.

I changed the value of kern.ipc.maxsockbuf to 16777216 on opnsense.

Regards,

openvpn configuration (server)

Code: [Select]

proto udp6
lport 1195
dev tun1
dev-type tun
script-security 3
keepalive 10 60
persist-tun
persist-key
topology subnet
server 192.168.168.0 255.255.255.0
server-ipv6 fdde:6c68:3589::/64
client-config-dir ccd
#disable-dco
tun-mtu 1420
tls-server
dh /etc/openvpn/keys/dh2048.pem
ca /etc/openvpn/keys/vpn-s2s-ca.crt
cert /etc/openvpn/keys/vpn-s2s.pem
key /etc/openvpn/keys/vpn-s2s.key
log /var/log/openvpn-s2s.log
verb 6
route-ipv6 2001:db8:3053:100::/57
route-ipv6 fde6:66ba:24ff::/48
OSPFv2 configuration (server)

Code: [Select]

log syslog notifications
frr defaults traditional
!
!
!
interface eth0
  ip ospf network point-to-point
  ip ospf area 0.0.0.0
!
interface tun1
  ip ospf network point-to-point
  ip ospf area 0.0.0.0
!
!
router ospf
  redistribute connected
!
!
!
line vty
!
OSPFv3 configuration (server)

Code: [Select]

log syslog notifications
frr defaults traditional
!
!
!
interface eth0
  ipv6 ospf6 network point-to-point
  ipv6 ospf6 area 0.0.0.0
!
interface tun1
  ipv6 ospf6 network point-to-point
  ipv6 ospf6 area 0.0.0.0
!
!
router ospf6
  redistribute connected
!
!
!
line vty
!

openvpn configuration (opnsense client)

Code: [Select]

client
dev ovpnc4
remote vpn-s2s.acme.com
persist-tun
persist-key
dev-type tun
dev-node /dev/ovpn4
script-security 3
writepid /var/run/ovpn-instance-c21882e1-9a02-4529-b32e-d24a25be00b3.pid
daemon openvpn_client4
management /var/etc/openvpn/instance-c21882e1-9a02-4529-b32e-d24a25be00b3.sock unix
proto udp
verb 11
up /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup
down /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown
port 1195
tun-mtu 1420
route-ipv6 2000::/3
route-ipv6 fda7:e226:8895::/48
route-ipv6 2001:db8:3053:1a0::/59
route-ipv6 fdde:6c68:3589::/48
route 0.0.0.0 128.0.0.0
route 128.0.0.0 128.0.0.0
OSPFv2 configuration (opnsense client)

Code: [Select]

log syslog notifications
frr defaults traditional
!
!
!
interface ovpnc4
  ip ospf network point-to-point
  ip ospf area 0.0.0.0
!
!
router ospf
 ospf router-id 192.168.168.2
 redistribute connected
!
!
!
line vty
!
OSPFv3 configuration (opnsense client)

Code: [Select]

log syslog notifications
frr defaults traditional
!
!
!
interface ovpnc4
  ipv6 ospf6 network point-to-point
!
!
router ospf6
 ospf6 router-id 192.168.168.2
 redistribute connected
 interface ovpnc4 area 0.0.0.0
!
line vty
!