GitLab

With the current lilypad there's a funny routing bug: when connected to the VPN, you can't access internal services (fetch new cert, admin panel..).

https://community.openvpn.net/openvpn/ticket/1161 explains why it's not working with current OpenVPN: See also leap/bitmask_android#8996 (closed)

 The valid use case is when the VPN server is part of an internal network of which you want to route through the tunnel itself. For example:

    VPN client network: 172.28.128.0/24
    VPN server network address: 172.28.128.254
    VPN server public address: 1.2.3.94/28, making the server part of network 1.2.3.80-1.2.3.95.

In this case it makes sense to push the following routes:

    push "route 1.2.3.80 255.255.255.240 172.28.128.254"
    push "route 1.2.3.94 255.255.255.255 net_gateway"

That allows VPN clients to communicate with 1.2.3.80/28 through the secure tunnel they've established without accidentally breaking access to the VPN server itself, as VPN clients must always reach this through their default gateway "net_gateway".

As mike_SF pointed out the use case with IPv6 is identical. Let's look at an example for IPv6:

    VPN client network: 2a02:1234:5678:128::/64
    VPN server network address: 2a02:1234:5678:128:fff:ffff:ffff:ffff
    VPN server public address: 2a02:1234:5678:1:fff:ffff:ffff:ffff

As with the IPv4 case it makes sense to push the following routes:

    push "route-ipv6 2a02:1234:5678:1::/64 2a02:1234:5678:128:ffff:ffff:ffff:ffff"
    push "route-ipv6 2a02:1234:5678:1:fff:ffff:ffff:ffff net_gateway"