Title: OpenVPN as the default gateway on OpenBSD

	Title: OpenVPN as the default gateway on OpenBSD
	Author: Solène
	Date: 27 October 2020
	Tags: openbsd openvpn
	Description:

	If you plan to use an OpenVPN tunnel to reach your default gateway,
	which would make the tun interface in the `egress` group, and use
	`tun0` in your `pf.conf` which is loaded before OpenVPN starts?

	Here are the few tips I use to solve the problems.


	## Remove your current default gateway

	We don't want a default gateway on the system. You need to know
	the remote address of the VPN server.

	If you have a `/etc/mygate` file, remove it.

	The `/etc/hostname.if` file (with if being your interface name,
	like em0 for example), should look like this:

	192.168.1.200
	up
	!route add -host A.B.C.D 192.168.1.254

	+ First line is the IP on my lan
	+ Second line is to make the interface up.
	+ Third line is means you want to reach `A.B.C.D` via `192.168.1.254`,
	with the IP `A.B.C.D` being the remote VPN server.


	## Create the tun0 interface at boot

	Create a `/etc/hostname.tun0` file with only `up` as content,
	that will create `tun0` at boot and make it available to `pf.conf`
	and you prevent it from loading the configuration.

	You may think one could use "egress" instead of the interface name,
	but this is not allowed in queuing.


	## Don't let OpenVPN manage the route

	Don't use `redirect-gateway def1 bypass-dhcp` from the OpenVPN
	configuration, this will create a route which is not `default` and
	so the tun0 interface won't be in the egress group, which is not
	something we want.

	Add those two lines in your configuration file, to execute
	a script once the tunnel is established, in which we will make
	the default route.

	script-security 2
	up /etc/openvpn/script_up.sh

	In `/etc/openvpn/script_up.sh` you simply have to write

	#!/bin/sh
	/sbin/route add -net default X.Y.Z.A

	If you have IPv6 connectivity, you have to add this line:

	/sbin/route add -inet6 2000::/3 fe80::%tun0

	(not sure it's 100% correct for IPv6 but it works fine for me! If
	it's wrong, please tell me how to make it better).