OpenVPN protocol: Softether creates too large PUSH_REPLY packets with many routes, does not use `push-continuation`

Author: schwabeCreated Aug 1, 2022Updated Aug 6, 2026

Prerequisites

Configure Softether with a large number of routes and OpenVPN protocol

Description

In OpenVPN the size of a PUSH_REPLY is limited to 1024 (PUSH_BUNDLE_SIZE define). If a push reply is larger than this, it needs to end with push-continuation 2 and the rest of the PUSH_REPLY needs to split into further packets ending with push-continuation 2 with the last of the PUSH_REPLY ending in push-continuation 1

Background

We received a bug/patch report for OpenVPN increasing the size of PUSH_REPLY packets (https://patchwork.openvpn.net/patch/2604/). This patch would break backwards compatibility and is something that only a third party server can trigger. While the submitter does not mention the server software, we believe it to be Softether. If even the reporter is using a different server, Softether exhibits the same behaviour.

Source: SoftEtherVPN/SoftEtherVPN