Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is one server in the local network (running Debian 7) and one remote VPN server. I have no control over the remote VPN server. I need the server in the local network to provide services (webserver etc.) to the internet directly, while I need other connections to be tunneled over the remote VPN.

I know how to setup the local server to use the remote VPN server using OpenVPN but then all connections are tunneled and the server is not listening to incoming connections from the internet anymore (only to incoming connections through the remote vpn) and can not make untunneled connections to the internet.

Is there any way to configure OpenVPN or Debian to allow two types of connection at once so that I can bind all the internet services to the internet, while binding others to the tunneled network?

share|improve this question
up vote 0 down vote accepted

To achieve split tunnelling, even though the remote server instructs the OpenVPN client to use the tunnel for everything, you should create a route-up script on the client that overrides the default route:

/sbin/route delete default
/sbin/route add default $route_net_gateway

That should re-establish the default route that existed before the VPN connection was established.

share|improve this answer

This happens when OpenVPN is configured to tell the client to automatically route all traffic through the VPN. You will need to disable this.

Look for a redirect-gateway option in your OpenVPN server configuration and remove it. For instance it might look like one of the following:

push "redirect-gateway def1"
push "redirect-gateway local def1"

You might need to set up additional static routes for networks on the other side of the VPN connection as well.

share|improve this answer
Thanks for your answer I will have a look into the additional static routes as they might help me on the client side. Sorry that I did not mention it but I have no control over the remote VPN server. – Kazuo Aug 2 '13 at 3:09
Then there's not much you can do, except to contact whoever does control the VPN server. – Michael Hampton Aug 2 '13 at 3:09
So did I get this right: The server can tell the client that it should only listen to incoming connections on the VPN connection and not on the local/internet connection? And there is no way to override this on the client side? – Kazuo Aug 2 '13 at 3:13
As far as I know this is controllable on the server side only. – Michael Hampton Aug 2 '13 at 3:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.