Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am testing the creation of an enforced default route of only public IPv4 space via OpenVPN. OpenVPN does not support

out of the box, because it contains code that rejects it. But if you remove that code and get iroute to work, logically the connection times out after a while because OpenVPN gets confused.

I found out that the minimal range to iroute is a /4. So if you want to divide all IPv4 space into /4 blocks, you end up with 16 blocks ranging from to But this contains all routable and unroutable IPs... so the list needs to be further delimited.

Because of a non-generic setup I cannot use redirect-gateway stuff. That's why I I am looking for a list of subnets, that is as short as possible, of the public IP ranges that exist. The list has to exclude ranges that are reserved (and my own server's public IP/32). Basically, I'd like to have a list of the opposite of RFC 5735 (page 6)

Does such a list exist and/or how can one be generated?

share|improve this question
I should add two things. 1) I am using Linux. 2) OpenVPN has an internal routing table. So simply adding the routes into Linux' routing tables is not enough. Believe me, I tried. – drumfire Sep 10 '11 at 11:00
Add that to your question with an edit, don't use a comment. – womble Sep 10 '11 at 11:00
up vote 1 down vote accepted

Why are you using iroute? I just have 'push "route"' in my OpenVPN server config and it works great (well, I need to knobble the default route that comes out of DHCP, but that's trivial).

share|improve this answer
Yes, I understand your question. I am using this because the setup actually goes via two openvpn connections: one of the clients of the OpenVPN server must route these. That is why I have to use iroute. In your case, you could also choose to use 'push "redirect-gateway"' and, for clients you want to except from this, use 'push-reset' – drumfire Sep 10 '11 at 11:04
When I started using OpenVPN, redirect-gateway well and truly didn't exist. Perhaps you might want to consider my answer to this rather similar question. Not that having a route for unrouteable addresses should cause any problems, because they shouldn't get further than the first firewall they meet anyway. – womble Sep 10 '11 at 11:13
Ha, yes. The answers also contain a link to and this seems to be exactly what I need. (I wonder if it can be made more compact.) Thank you! – drumfire Sep 10 '11 at 11:20
Well, netmask takes multiple ranges and condenses them, but the list is patchy enough that there's not a lot of aggregation that is effective. – womble Sep 10 '11 at 11:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.