Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenVPN server on ubuntu and the client (Openvpn 2.1_rc19) on windows7 x64.
The connection is established an I can use it. However not all traffic is routed through the openvpn interface and so I have different is's on different servers.

e.g.: IP= sees only the external ip of my vpn server IP= sees the ip of my regular dialup connection

I guess it is a routing issue, so her is "route print" from the windows client

 27...00 ff 1a c3 26 d6 ......TAP-Win32 Adapter V9
  1...........................Software Loopback Interface 1

Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
   Auf Verbindung    109.84.XXX.XXX     31   Auf Verbindung    259   Auf Verbindung    259   Auf Verbindung    259
   109.84.XXX.XXX   Auf Verbindung    109.84.XXX.XXX    286   Auf Verbindung   4531   Auf Verbindung   4531   Auf Verbindung   4531      4
   188.40.XXX.XXX   Auf Verbindung    109.84.XXX.XXX     30   Auf Verbindung    109.84.XXX.XXX     31      4   Auf Verbindung   4531   Auf Verbindung    259      4   Auf Verbindung    109.84.XXX.XXX    286
St„ndige Routen:

109.84.XXX.XXX is the external ip of my dialup (umts) 188.40.XXX.XXX is my servers external ip address is the openvpn network, with 6 being the client.

If I delete the the second entry those site will not work anymore, while those that are routed over vpn as they should still work.

What do I have to do so that everything is routed through openvpn ?

Edit: Server configuration

local 188.40.XXX.XXX
port 1194

proto tcp
dev tun
tun-mtu 1544

key /etc/openvpn/examples/easy-rsa/2.0/keys/server.key
ca /etc/openvpn/examples/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/examples/easy-rsa/2.0/keys/server.crt
dh /etc/openvpn/examples/easy-rsa/2.0/keys/dh2048.pem

ifconfig-pool-persist ipp.txt

keepalive 10 120

max-clients 5


status /tmp/openvpn-status.log
log-append  /var/log/openvpn.log
verb 4

push "redirect-gateway def1"
push "dhcp-option DNS"
push "dhcp-option DNS"
push "dhcp-option DNS"
push "dhcp-option DNS"

Client Config:

dev tun
proto tcp
remote 188.40.XXX.XXX 1194
resolv-retry infinite
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
cipher AES-128-CBC
verb 4
share|improve this question
Why does everyone always mask host specific portion of IP addresses. It would be far more useful for diagnostics/troubleshooting if you masked out the network and told us the host portion of your routes... Next time if you have and address, tell us the xx.xx.30.40, not the other way around. Or just replace the network part with addresses from the RFC1918 range... – Zoredache Aug 22 '10 at 0:06
Really? I always thought the network portion was more interesting... But okay, will do. Thanks for the tip. – Darcara Aug 22 '10 at 0:16

In your server config you probably currently have the setting redirect-gateway. Try replacing that with the redirect-gateway def1.

This option will create 2 routes and instead of a route for Because these routes are more specific they should be used instead of your configured default gateway.

share|improve this answer
I had "redirect-gateway def1 bypass-dhcp" in there. I changed it as you recommended, but after a reconnect nothing changed. – Darcara Aug 22 '10 at 0:09
up vote 0 down vote accepted

It works now.
I deleted the default route the dial up gave me and added a route only to my openvpn server. That did the trick, as now openvpn could push all routes to me, including the default route :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.