OpenVPN v3 core routes 255.255.255.255 broadcast into the tunnel, breaking LAN software

[ValdikSS]

General information

• Android Version: 10
• Android Vendor/Custom ROM: LG
• Device: LG V50
• Version of the app (version number/play store version/self-built): 0.7.61 F-Droid

Description of the issue

On Android smartphone, connecting to the VPN with OpenVPN Connect or OpenVPN for Android with v3 core results in routing the 255.255.255.255 broadcast address into the tunnel, which makes some applications, such as KDE Connect, unable to discover LAN peers.

# With OpenVPN for Android, v2 core - destination is wlan0

flashlm:/ $ ip r g 255.255.255.255
broadcast 255.255.255.255 dev wlan0 table 1036 src 192.168.70.11 uid 2000 
    cache <local,brd> 

# With OpenVPN for Android, v3 core - destination is tun0

flashlm:/ $ ip r g 255.255.255.255                                                                                                                                                                            
broadcast 255.255.255.255 dev tun0 table 1089 src 192.168.101.37 uid 2000 
    cache <local,brd>

# With OpenVPN Connect, "Allow LAN access" enabled - destination is tun0

flashlm:/ $ ip r g 255.255.255.255
broadcast 255.255.255.255 dev tun0 table 1091 src 192.168.101.37 uid 2000 
    cache <local,brd>

OpenVPN for Android v2 adds a particular set of routes to route only "the internet" inside the tunnel with the default redirect-gateway configuration, without adding default route:

# ip route show table all

default via 192.168.70.1 dev wlan0 table 1036 proto static
192.168.70.0/24 dev wlan0 table 1036 proto static scope link
0.0.0.0/1 dev tun0 table 1088 proto static scope link
128.0.0.0/2 dev tun0 table 1088 proto static scope link
192.0.0.0/9 dev tun0 table 1088 proto static scope link
192.128.0.0/11 dev tun0 table 1088 proto static scope link
192.160.0.0/13 dev tun0 table 1088 proto static scope link
192.168.0.0/18 dev tun0 table 1088 proto static scope link
192.168.64.0/22 dev tun0 table 1088 proto static scope link
192.168.68.0/23 dev tun0 table 1088 proto static scope link
192.168.71.0/24 dev tun0 table 1088 proto static scope link
192.168.72.0/21 dev tun0 table 1088 proto static scope link
192.168.80.0/20 dev tun0 table 1088 proto static scope link
192.168.96.0/19 dev tun0 table 1088 proto static scope link
192.168.101.0/24 dev tun0 table 1088 proto static scope link
192.168.128.0/17 dev tun0 table 1088 proto static scope link
192.169.0.0/16 dev tun0 table 1088 proto static scope link
192.170.0.0/15 dev tun0 table 1088 proto static scope link
192.172.0.0/14 dev tun0 table 1088 proto static scope link
192.176.0.0/12 dev tun0 table 1088 proto static scope link
192.192.0.0/10 dev tun0 table 1088 proto static scope link
193.0.0.0/8 dev tun0 table 1088 proto static scope link
194.0.0.0/7 dev tun0 table 1088 proto static scope link
196.0.0.0/6 dev tun0 table 1088 proto static scope link
200.0.0.0/5 dev tun0 table 1088 proto static scope link
208.0.0.0/4 dev tun0 table 1088 proto static scope link
…
2000::/4 dev tun0 table 1088 proto static metric 1024 pref medium
3000::/4 dev tun0 table 1088 proto static metric 1024 pref medium
fc00::/7 dev tun0 table 1088 proto static metric 1024 pref medium
fe80::/64 dev tun0 table 1088 proto kernel metric 256 pref medium
…

Notice that the last rule is 208.0.0.0/4, which is 208.0.0.1 - 223.255.255.254, does not include 255.255.255.255)

While with OpenVPN v3 uses just the default route

# ip route show table all

default via 192.168.70.1 dev wlan0 table 1036 proto static
192.168.70.0/24 dev wlan0 table 1036 proto static scope link
default dev tun0 table 1087 proto static scope link
192.168.101.0/24 dev tun0 table 1087 proto static scope link
…
(ipv6) default dev tun0 table 1087 proto static metric 1024 pref medium
…

My phone is quite old and running on 4.14 kernel, thus doesn't allow to use SO_BINDTODEVICE for the applications (it is allowed for non-root users since 5.7).

** Log (if applicable)

** Configuration file

[schwabe]

For OpenVPN for Android can you show the app's own log, especially the Android VPNService configuration that it is setting? All the low level stuff that you show is not really saying much without knowing what the app is trying to setup for the service.

[ValdikSS]

@schwabe, I'm looking on the ways to force verbosity of the application, but could not find anything. Adding verb 4 to the custom options does not help either.
Should I capture the log with adb logcat?

[schwabe]

@ValdikSS just use the slider in the log window

[ValdikSS]

Oh, I'm dumb :D

2025-08-07 12:49:44 F-Droid built and signed version 0.7.61 running on lge LM-V450 (msmnile), Android 10 (QKQ1.191021.002) API 29, ABI arm64-v8a, (lge/flashlm_lao_com/flashlm:10/QKQ1.191021.002/2115416565411:user/release-keys)
2025-08-07 12:49:44 Building configuration…
2025-08-07 12:49:44 Fetched VPN profile (se1-vip) triggered by main profile list
2025-08-07 12:49:44 Scheduling VPN keep alive for VPN se1-vip
2025-08-07 12:49:44 Network Status: CONNECTED to WIFI
2025-08-07 12:49:44 Debug state info: CONNECTED to WIFI , pause: userPause, shouldbeconnected: true, network: SHOULDBECONNECTED
2025-08-07 12:49:44 Debug state info: CONNECTED to WIFI , pause: userPause, shouldbeconnected: true, network: SHOULDBECONNECTED
2025-08-07 12:49:44 OpenVPN core 3.12_git:master(icsopenvpn/v0.7.60-0-ge43f5fb4) android arm64 64-bit
2025-08-07 12:49:44 Copyright (C) 2012- OpenVPN Inc. All rights reserved.
2025-08-07 12:49:44 OpenVPN core 3.12_git:master(icsopenvpn/v0.7.60-0-ge43f5fb4) android arm64 64-bit
2025-08-07 12:49:44 Frame=512/2112/512 mssfix-ctrl=1250
2025-08-07 12:49:44 NOTE: This configuration contains options that were not used:
2025-08-07 12:49:44 Ignored options prefixed with 'setenv opt'
2025-08-07 12:49:44 0 [block-outside-dns]
2025-08-07 12:49:44 Unsupported option (ignored)
2025-08-07 12:49:44 0 [connect-retry] [2] [300]
2025-08-07 12:49:44 1 [resolv-retry] [60]
2025-08-07 12:49:44 2 [persist-tun]
2025-08-07 12:49:44 3 [preresolve]
2025-08-07 12:49:44 4 [data-ciphers] [CHACHA20-POLY1305:AES-128-GCM:AES-256-GCM]
2025-08-07 12:49:44 5 [resolv-retry] [infinite]
2025-08-07 12:49:44 EVENT: RESOLVE:
2025-08-07 12:49:44 Contacting server.ip.addr.here:993 via TCP
2025-08-07 12:49:45 EVENT: WAIT:
2025-08-07 12:49:45 Connecting to [server.ip.addr.here]:993 (server.ip.addr.here) via TCP
2025-08-07 12:49:45 EVENT: CONNECTING:
2025-08-07 12:49:45 Tunnel Options:V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client
2025-08-07 12:49:45 Creds: UsernameEmpty/PasswordEmpty
2025-08-07 12:49:45 Sending Peer Info:
IV_VER=3.12_git:master
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=8094
IV_MTU=1600
IV_CIPHERS=AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
IV_AUTO_SESS=1
IV_GUI_VER=de.blinkt.openvpn 0.7.61
IV_SSO=openurl,webauth,crtext
IV_BS64DL=1
2025-08-07 12:49:45 TLS Handshake: peer certificate: CN=server.dns.name.here, 2048 bit RSA, cipher: TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD, key-agreement: x25519
2025-08-07 12:49:45 Session is ACTIVE
2025-08-07 12:49:45 EVENT: GET_CONFIG:
2025-08-07 12:49:45 Sending PUSH_REQUEST to server...
2025-08-07 12:49:45 OPTIONS:
0 [dhcp-option] [DNS] [192.168.101.1]
1 [redirect-gateway] [def1] [bypass-dhcp]
2 [route-gateway] [192.168.101.1]
3 [topology] [subnet]
4 [ping] [30]
5 [ping-restart] [65]
6 [socket-flags] [TCP_NODELAY]
7 [block-outside-dns]
8 [dhcp-option] [DNS6] [2001:4860:4860::8888]
9 [route-ipv6] [2001:4860:4860::8888/128]
10 [redirect-gateway] [ipv6]
11 [ifconfig-ipv6] [2a02:xxxx:yyyy::zzzz:ttt2/124] [2a02:xxxx:yyyy::zzzz:ttt0]
12 [ifconfig] [192.168.101.37] [255.255.255.0]
13 [peer-id] [0]
14 [cipher] [CHACHA20-POLY1305]
2025-08-07 12:49:45 PROTOCOL OPTIONS:
key-derivation: OpenVPN PRF
data channel: cipher CHACHA20-POLY1305, peer-id 0
2025-08-07 12:49:45 EVENT: ASSIGN_IP:
2025-08-07 12:49:45 exception parsing IPv4 route: [route] [192.168.70.11/24] [] [net_gateway] : tun_prop_error: route is not canonical
2025-08-07 12:49:45 exception parsing IPv6 route: [route-ipv6] [fe80:0:0:0:c831:2f2c:b59c:71a8/64] [net_gateway] : tun_prop_error: route is not canonical
2025-08-07 12:49:45 We should call this sessionserver.ip.addr.here
2025-08-07 12:49:45 Opening tun interface:
2025-08-07 12:49:45 Local IPv4: 192.168.101.37/24 IPv6: 2a02:xxxx:yyyy::zzzz:tttt/124 MTU: 1500
2025-08-07 12:49:45 DNS Server: 192.168.101.1, 2001:4860:4860::8888, Domain:
2025-08-07 12:49:45 Routes: 0.0.0.0/0 ::/0, 2a02:xxxx:yyyy:0:0:0:zzzz:rrrr/128
2025-08-07 12:49:45 Routes excluded:
2025-08-07 12:49:45 VpnService routes installed: 0.0.0.0/0 ::/0
2025-08-07 12:49:45 Disallowed VPN apps:
2025-08-07 12:49:45 TunPersist: saving tun context:
Session Name: server.ip.addr.here
Layer: OSI_LAYER_3
Remote Address: server.ip.addr.here
Tunnel Addresses:
192.168.101.37/24 -> 192.168.101.1
2a02:xxxx:yyyy::zzzz:ttt2/124 -> 2a02:xxxx:yyyy::zzzz:ttt0 [IPv6]
Reroute Gateway: IPv4=1 IPv6=1 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 IPv6 ]
Block IPv4: no
Block IPv6: no
Block local DNS: yes
Add Routes:
2001:4860:4860::8888/128 [IPv6]
Exclude Routes:
DNS Servers:
Priority: 0
Addresses:
192.168.101.1
2001:4860:4860::8888
Values from dhcp-options: true
2025-08-07 12:49:45 Connected via tun
2025-08-07 12:49:45 EVENT: CONNECTED: server.ip.addr.here:993 (server.ip.addr.here) via /TCP on tun/192.168.101.37/2a02:xxxx:yyyy::zzzz:tttt gw=[192.168.101.1/2a02:xxxx:yyyy::zzzz:ttt0] mtu=(default)
2025-08-07 12:49:45 Debug state info: CONNECTED to WIFI , pause: userPause, shouldbeconnected: true, network: SHOULDBECONNECTED

[schwabe]

2025-08-07 12:49:45 VpnService routes installed: 0.0.0.0/0 ::/0

So that is what the app tells Android what to do. So it does not specifically ask for anything else. So what you are seeing is netd/Android/LG's doing.

But I think your problem is actually something else. You are routing everything to the VPN, that means everything. Android will prefer VPN routes over other routes, e.g. also over more specific routes. There is a switch in the app to allow local lan access.

If there is truly something that the API does wrong with 255.255.255.255, try using 0/0 and 128/0 as routes instead of 0/0. Or try to exclude that specific IP from the VPN.

[ValdikSS]

If there is truly something that the API does wrong with 255.255.255.255, try using 0/0 and 128/0 as routes instead of 0/0. Or try to exclude that specific IP from the VPN.

Well, I do. I use redirect-gateway def1 on the server, and have "Bypass VPN for local networks" option checked in the configuration. It works as it should on v2 core (and I think that's your application which sets up these routes, as on the other OS def1 adds only /1 routes, not a bunch of LAN-excluding ones).

Should I do something special for v3 core in this case?

Here's what my server pushes:

PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.101.1,redirect-gateway def1 bypass-dhcp,route-gateway 192.168.101.1,topology subnet,ping 180,ping-restart 540,socket-flags TCP_NODELAY,block-outside-dns,dhcp-option DNS6 2a02:xxx,route-ipv6 2a02:xxx/128,redirect-gateway ipv6,ifconfig-ipv6 2a02:xxx/124 2a02:xxx,ifconfig 192.168.101.37 255.255.255.0,peer-id 0,cipher CHACHA20-POLY1305'

[schwabe]

Yeah OpenVPN 3++ is experimential and not the best supported option in OpenVPN for Android.

The app ignores def1 as there are some Android (esp Samsung) that have strange behaviour if you want all traffic over VPN but don't have the 0.0.0.0 route.

[ValdikSS]

If the application correctly binds to the Wi-Fi's source address, everything works fine. But I'm afraid many applications still don't handle such multihoming well.

I also created a ticket to OpenVPN Connect support. Let's see what they will tell.