Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Quick question just to verify i'm not going mental. If using device mode "tap" and i got a fully function connection in the sense that i can ping from client to server without any issues.

However, i want to force my traffic through the VPN and nothing can leak out, no matter what. I'm stuck on my head around this but shouldn't this be valid in the server.ovpn?

mode server
dev tap
dev-node TAP1


push "route"
push "route-gateway"
push "redirect-gateway def1"

The client.ovpn looks like:

dev tap
dev-node TAP1

The connection establishes and what not, the output of the clients log is:

ROUTE default_gateway=<external IP gateway>
PUSH: Recieved control message: 'PUSH_REPLY,route,route-gateway...
Notified TAP-Win32 driver to set a DHCP IP/netmask of on interface ...
Successful ARP Flush
Added routes 139.. 127.. 192...

All appears to be fine except that a default gateway just isn't set when checking ipconfig /all

The output of the route print looks like:

Destination        Netmask         Gateway           <external Gateway>   <-- Wrong?   On-link

The routing table appears to be off?

share|improve this question
Is IP forwarding turned on? This will be on the server. – cjc Feb 5 '13 at 20:26
server is running Windows 7, nothing outside of the config has been done. What i'm trying to acomplish is mainly a "dummy gateway" because certain software checks the default gateway parameter in windows for it's operation (mainly for connecting software to a "unknown" server) – Torxed Feb 5 '13 at 20:28
up vote 3 down vote accepted
All appears to be fine except that a default gateway just isn't 
set when checking 
push "redirect-gateway def1"

If you use that option, then you don't set a default gateway. Instead two routes should be added for, and to your VPN.

share|improve this answer
Ok is it possible to set a default gateway under ipconfig /all while still forcing all traffic through the VPN? – Torxed Feb 5 '13 at 20:31
Remove the def1 option. Keep in mind that the def1 option exists because some systems are buggy and will update the default gateway. For example, in the past some Linux systems would over-write the VPN provided default gateway, if the LAN interface was set to DHCP, and the renew time had occurred. The def1 option is generally more reliable, the downside of windows not showing it in ipconfig /all is purely cosmetic in my opinion. – Zoredache Feb 5 '13 at 20:40
Thank you, the def1 part was the dark sheep in my problem. I couldn't agree more that the ipconfig /all is purely cosmetic but as mentioned in another comment above, certain software depend on this to work properly and i have 0 control over that software for now even tho it's in house developed :) Thank you! – Torxed Feb 5 '13 at 20:52

I realize this is an old question, but I wanted to add that in my experience, if everything works EXCEPT for the setting of a default gateway, running OpenVPN as administrator will solve the problem on Windows 10.

share|improve this answer
Yepp this completely slipped my mind and was rather obvious on later years of using VPN, but good addition for anyone ending up here and are new to these kinda things for sure! – Torxed Mar 27 at 15:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.