这样弄 ocserv 的 no-route 路由表有问题吗？

[lenovo]

no-route = 1.0.0.0/255.0.0.0
no-route = 14.0.0.0/255.0.0.0
no-route = 27.0.0.0/255.0.0.0
no-route = 36.0.0.0/255.0.0.0
no-route = 39.0.0.0/255.0.0.0
no-route = 42.0.0.0/255.0.0.0
no-route = 43.0.0.0/255.0.0.0
no-route = 45.0.0.0/255.0.0.0
no-route = 47.0.0.0/255.0.0.0
no-route = 49.0.0.0/255.0.0.0
no-route = 54.0.0.0/255.0.0.0
no-route = 58.0.0.0/255.0.0.0
no-route = 59.0.0.0/255.0.0.0
no-route = 60.0.0.0/255.0.0.0
no-route = 61.0.0.0/255.0.0.0
no-route = 101.0.0.0/255.0.0.0
no-route = 103.0.0.0/255.0.0.0
no-route = 106.0.0.0/255.0.0.0
no-route = 110.0.0.0/255.0.0.0
no-route = 111.0.0.0/255.0.0.0
no-route = 112.0.0.0/255.0.0.0
no-route = 113.0.0.0/255.0.0.0
no-route = 114.0.0.0/255.0.0.0
no-route = 115.0.0.0/255.0.0.0
no-route = 116.0.0.0/255.0.0.0
no-route = 117.0.0.0/255.0.0.0
no-route = 118.0.0.0/255.0.0.0
no-route = 119.0.0.0/255.0.0.0
no-route = 120.0.0.0/255.0.0.0
no-route = 121.0.0.0/255.0.0.0
no-route = 122.0.0.0/255.0.0.0
no-route = 123.0.0.0/255.0.0.0
no-route = 124.0.0.0/255.0.0.0
no-route = 125.0.0.0/255.0.0.0
no-route = 139.0.0.0/255.0.0.0
no-route = 140.0.0.0/255.0.0.0
no-route = 144.0.0.0/255.0.0.0
no-route = 150.0.0.0/255.0.0.0
no-route = 152.0.0.0/255.0.0.0
no-route = 153.0.0.0/255.0.0.0
no-route = 157.0.0.0/255.0.0.0
no-route = 159.0.0.0/255.0.0.0
no-route = 161.0.0.0/255.0.0.0
no-route = 162.0.0.0/255.0.0.0
no-route = 163.0.0.0/255.0.0.0
no-route = 166.0.0.0/255.0.0.0
no-route = 167.0.0.0/255.0.0.0
no-route = 168.0.0.0/255.0.0.0
no-route = 171.0.0.0/255.0.0.0
no-route = 175.0.0.0/255.0.0.0
no-route = 180.0.0.0/255.0.0.0
no-route = 182.0.0.0/255.0.0.0
no-route = 183.0.0.0/255.0.0.0
no-route = 192.0.0.0/255.0.0.0
no-route = 202.0.0.0/255.0.0.0
no-route = 203.0.0.0/255.0.0.0
no-route = 210.0.0.0/255.0.0.0
no-route = 211.0.0.0/255.0.0.0
no-route = 218.0.0.0/255.0.0.0
no-route = 219.0.0.0/255.0.0.0
no-route = 220.0.0.0/255.0.0.0
no-route = 221.0.0.0/255.0.0.0
no-route = 222.0.0.0/255.0.0.0
no-route = 223.0.0.0/255.0.0.0

64行，看了下ios上cisco anyconnect的路由表，貌似都收到了
用起来貌似也分流了，就是不知道有多大误差？

[LazyZhu]

64+200 应该有个最优解的

[LazyZhu]

route和no-route在ocserv里面哪个优先判断，这关系到路由表的分配

[sdysj]

误差不大，就算误差都是些东南亚或者新西兰之类的，cloudflare 可能受点影响。

[regeditms]

route 和 no-route 只能存在一个。优先判断route，这两个都能有200条，楼主你这样是过滤国内的吗？我试过 国内ip段 前200条 但是感觉效果还是不那么好。

[ddqp]

这个应该放在哪里？

[lenovo]

@LazyZhu @regeditms 我的route是空的

@ddqp 放ocserv.conf里

[LazyZhu]

@regeditms 看文档说明是可以一起用的
# To set the server as the default gateway for the client just
# comment out all routes from the server, or use the special keyword
# ’default’.

route = 10.10.10.0/255.255.255.0
route = 192.168.0.0/255.255.0.0
#route = fef4:db8:1000:1001::/64

# Subsets of the routes above that will not be routed by
# the server. Note, that this may currently be not be supported
# by openconnect clients.

no-route = 192.168.5.0/255.255.255.0


http://www.infradead.org/ocserv/manual.html

[ddqp]

谢谢，我回去试试看

[lucifer9]

文档只是分别说了两者的用法而已
至于是否可以一起用，试试就知道了

[LazyZhu]

no-route优先级别比route高，上面样例效果就是路由192.168.0.0/16 ，但是排除192.168.5.0/24
关键是客户端也得支持

[LazyZhu]

@lucifer9 再去读读，aboue...above...above

[Daniel65536]

Anyconnect不支持混用。以最后一条是route还是noroute决定只保留哪种。

[LazyZhu]

@Daniel65536

[LazyZhu]

Cisco开发人员明显偷懒了
OpenConnect 应该支持的

[bellchu]

帮你汇总了一下

1.0.0.0/8
14.0.0.0/8
27.0.0.0/8
36.0.0.0/8
39.0.0.0/8
42.0.0.0/7
45.0.0.0/8
47.0.0.0/8
49.0.0.0/8
54.0.0.0/8
58.0.0.0/7
60.0.0.0/7
101.0.0.0/8
103.0.0.0/8
106.0.0.0/8
110.0.0.0/7
112.0.0.0/5
120.0.0.0/6
124.0.0.0/7
139.0.0.0/8
140.0.0.0/8
144.0.0.0/8
150.0.0.0/8
152.0.0.0/7
157.0.0.0/8
159.0.0.0/8
161.0.0.0/8
162.0.0.0/7
166.0.0.0/7
168.0.0.0/8
171.0.0.0/8
175.0.0.0/8
180.0.0.0/8
182.0.0.0/7
192.0.0.0/8
202.0.0.0/7
210.0.0.0/7
218.0.0.0/7
220.0.0.0/6

[bellchu]

@LazyZhu
应该反过来说
OpenConnect开发人员明显偷懒了
Cisco应该支持的

Cisco用的是Split Tunnel，用ACL控制哪些流量走VPN Tunnel，哪些走default gateway。

[lenovo]

@bellchu 要是支持ACL分流就精确多了

[loca1h0st]

貌似熊猫翻就是用的顶楼的路由表？

[Yien]

0.10.2还是会断，不知道0.10.4解决没有。

[bellchu]

@lenovo 楼主贴的是APNIC的Asia IP Range， 范围太大了

这个是APNIC的所有详细IP信息

自己用vim提取一下中国的IP就行了