Mac users report unexpected 2000::/3 route injection

Pritunl Pritunl VPN
1

Hi!

Mac users are reporting that the newest client is injecting 2000::/3 route even when the disable default route is ticked. It happens with a recently deployed server (v1.32.3805.95) that is sending both IPv4 and IPv6 default routes (0.0.0.0/0 + ::/0 are in config).

Interestingly, it happens only with OpenVPN and not in WG mode.

OpenVPN:

ip -6 route                                                                                                                              15:29:30
default via fe80::46fe:3bff:fe73:584d%en0 dev en0
::1 via ::1 dev lo0
2000::/3 via utun8 dev utun8
2001:4c08:2003:b09::/64 via utun8 dev utun8
2600:c00:2:100::/56 via utun8 dev utun8
2602:fb2b:100::/48 via utun8 dev utun8
2602:fb2b:110::/49 via utun8 dev utun8
2602:fb2b:110:1000::/64 via fe80::34f8:5142:2259:8921%utun8 dev utun8
2602:fb2b:110:1000:a0e8:0:a0e8:3 dev lo0 scope link
2602:fb2b:110:1001:a0e8::/96 via utun8 dev utun8
2602:fb2b:110:ff00::a001 via fe80::46fe:3bff:fe73:584d%en0 dev en0
2602:fb2b:120::/48 via utun8 dev utun8
2604:6800:258::/63 via utun8 dev utun8
2a00:fb01:400::/56 via utun8 dev utun8
2a00:fb01:400:200::/64 via utun8 dev utun8
2a04:ee41:3:f403::/64 dev en0 scope link
2a0b:21c0:4003::/62 via utun8 dev utun8
2a0b:21c0:4006:100::/56 via utun8 dev utun8
2a0b:21c0:b002:2::/64 via utun8 dev utun8

WG:

ip -6 route                                                                                                                              15:30:09
default via fe80::46fe:3bff:fe73:584d%en0 dev en0
::1 via ::1 dev lo0
2001:4c08:2003:b09::/64 via utun8 dev utun8
2600:c00:2:100::/56 via utun8 dev utun8
2602:fb2b:100::/48 via utun8 dev utun8
2602:fb2b:110::/49 via utun8 dev utun8
2602:fb2b:110:1000:a0e8::/96 via utun8 dev utun8
2602:fb2b:110:1001::/64 via fe80::34f8:5142:2259:8921%utun8 dev utun8
2602:fb2b:110:1001:a0e8::/96 via utun8 dev utun8
2602:fb2b:110:1001:a0e8:0:a0e8:7fa dev lo0 scope link
2602:fb2b:120::/48 via utun8 dev utun8
2604:6800:258::/63 via utun8 dev utun8
2a00:fb01:400::/56 via utun8 dev utun8
2a00:fb01:400:200::/64 via utun8 dev utun8
2a04:ee41:3:f403::/64 dev en0 scope link
2a04:ee41:3:f403:a8:82f8:ea7d:dd80 via e2:72:1e:c8:d1:ac dev lo0
2a04:ee41:3:f403:b8f2:571b:5277:4157 via e2:72:1e:c8:d1:ac dev lo0
2a0b:21c0:4003::/62 via utun8 dev utun8
2a0b:21c0:4006:100::/56 via utun8 dev utun8
2a0b:21c0:b002:2::/64 via utun8 dev utun8
2

This is similar to routing 0.0.0.0/1 and 128.0.0.0/1 in IPv4 to avoid effecting the default gateway. The range 2000::/3 covers all public (global unicast) IPv6 addresses. It’s done in pritunl/clients/clients.py. This has been done for a while now.

3

The issue has been fixed in the client repository to ignore this route when disable gateway is enabled. This will be included in the next release this week.

1 Like