Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

if openvpn is running, normal internet connections don't work.

My wlan-router is

root@e520:~# ip route show
default via dev eth0  proto static via dev tap0 via dev tap0 dev wlan0  scope link  metric 1000 via dev tap0 dev virbr0  proto kernel  scope link  src dev tap0  proto kernel  scope link  src dev eth0  proto kernel  scope link  src  metric 1 dev wlan0  proto kernel  scope link  src  metric 2 via dev wlan0 

If I try to do a non-openvpn connection the wrong route gets chosen:

root@e520:~# tcptraceroute http
Selected device tap0, address, port 41576 for outgoing packets
Tracing the path to ( on TCP port 80 (www), 30 hops max
 1 ... hanging

Why does get used to access this IP address?

share|improve this question
up vote 1 down vote accepted has address

The longest prefix match in your routing table is: via dev tap0

Which tells the kernel to route the packet via the VPN. You have the redirect-gateway option set (either in the client configuration, or pushed by the server). This causes OpenVPN to add routes so that all traffic is routed via the VPN (although I'm not sure why you have 128/1 and not 0/1 as well). Remove the redirect-gateway configuration directive and your routing should work normally.

share|improve this answer
The routing is done by the linux, and I posted my routing table. If I start tcptraceroute it says "Selected device tap0, address". At this level OpenVPN does not interfere. Why does the device tap get chosen? Why does the default-gw not get used? – guettli Apr 25 '12 at 20:32
Your routing table is telling the kernel to route the packet via OpenVPN (clarified in answer). – mgorven Apr 25 '12 at 20:40
Thank you for the clarified answer! BTW "longest prefix match" is explained here: – guettli Apr 26 '12 at 7:17
Yes, after ip route del via dev tap0 it worked. Now I check the redirect-gateway option. – guettli May 22 '12 at 19:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.