Skip to content

Conversation

cnbatch
Copy link

@cnbatch cnbatch commented May 7, 2024

This patch is to support FreeBSD's FIB feature.

When using FreeBSD's setfib command to launch OpenVPN in other FIB (routing table), the interface's IP address was not added to correct routing table, and then the routing entries couldn't be added successfully:
https://forums.freebsd.org/threads/freebsd-14-and-route-in-non-zero-fib.91099/
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=278295

This is duo to ifconfig command does not retrieve FIB number of current envirnment which is set by setfib. It only accepts fib N parameter.
route command can retrieve FIB number of current envirnment, the following routing entries will be added to correct routing table. But if the interface's IP address was not added correct routing table, route command will fail.

@schwabe
Copy link
Contributor

schwabe commented May 8, 2024

I am wondewring if the ifconfig behaviour is intended behaviour or if we working around a bug in ifconfig here in OpenVPN.

@schwabe
Copy link
Contributor

schwabe commented May 8, 2024

There are also build failures related to macOS.

@flichtenheld
Copy link
Member

There are also build failures related to macOS.

Yeah, these are related to the code that was not moved correctly.

cnbatch and others added 3 commits May 8, 2024 21:40
Co-authored-by: Frank Lichtenheld <frank@lichtenheld.com>
Copy link
Author

@cnbatch cnbatch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all changes have made

@cnbatch
Copy link
Author

cnbatch commented Sep 1, 2024

Sorry, it seems I misunderstood earlier.
This doesn't appear to be a FreeBSD bug but rather a requirement of ifconfig. According to FreeBSD's documentation, if a FIB number needs to be specified, it must be explicitly stated it in ifconfig; otherwise, the default FIB (main route table) will be used:
https://man.freebsd.org/cgi/man.cgi?ifconfig

fib	fib_number
	       Specify interface FIB.  A FIB fib_number	 is  assigned  to  all
	       frames  or  packets received on that interface.	The FIB	is not
	       inherited, e.g.,	vlans or other sub-interfaces will use the de-
	       fault FIB (0) irrespective of the parent	interface's FIB.   The
	       kernel  needs  to be tuned to support more than the default FIB
	       using the  ROUTETABLES  kernel  configuration  option,  or  the
	       net.fibs	tunable.

@janondrusek
Copy link

Is there a way this could be rebased and merged? FreeBSD still cannot effectively use a separate routing table with OpenVPN.

My own attempts end with errors too:

2025-10-13 20:35:50 /sbin/ifconfig tun0 10.x.x.x/16 mtu 1500 up
add net y.y.y.y: gateway 127.0.0.1 fib 1
add net 0.0.0.0: gateway 10.x.x.1 fib 1: Invalid argument
2025-10-13 20:35:50 ERROR: FreeBSD route add command failed: external program exited with error status: 1
add net 128.0.0.0: gateway 10.x.x.1 fib 1: Invalid argument
2025-10-13 20:35:50 ERROR: FreeBSD route add command failed: external program exited with error status: 1
2025-10-13 20:35:50 Initialization Sequence Completed

@cron2
Copy link
Contributor

cron2 commented Oct 14, 2025

This is a relevant feature, but needs good design and careful thinking (OpenBSD has FIB support as well, Linux has vrf/namespace support, and we want to be able to ifconfig in whatever a platform has).

For 2.7, the ship has sailed - lack of time on my side to followup on this, and do more thinking on the design. 2.7.0 release is "around the corner", and we're in the "bugfixes, integers, and non-intrusive last-minute changes" territory.

We need to come back to this after 2.7.0 release, so roughly "end of November".

@cron2
Copy link
Contributor

cron2 commented Oct 14, 2025

Side note: networking_freebsd.c already has fib support, we just don't use it for normal routes yet. This is one of the places where a larger cleanup is needed anyway, and we get route-fib-support for free. Won't help with ifconfig-fib-support.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants