I need to setup a OpenVPN network which will probably grow to a serval hundreds of clients in the next few months. Some of the clients are servers and others are devices that need services, hosted on the server(s).

The idea is to use a network where all clients are into. The servers shoud have a static VPN IP in the range - and the should have DHCP VPN IP's in the range - The OpenVPN server (currently 1) has IP

To distribute the static "server" IP's, i uncommented client-config-dir in the OpenVPN server.conf , created a config file for each server in ccd with the servers CN name as filename and added route to server.conf. Each client file contains something like this:

ifconfig-push 10.10.0.x

When i try to ping from one of the servers with an static VPN IP, i the ping is successfull.

For the DHCP clients i set some configurations in server.conf:

dev tun
proto udp
dev tun
mode server
push "route-gateway"
push "route"

The clients connect correctly and get an IP in the expected range (e.g but when i try to ping to, the ping times out. When i check the gateways with route -n i see that the wrong gateway is set:

root@somedevice:/home/pi# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    202    0        0 eth0 UH    0      0        0 tun0    <-- should be ?   U     202    0        0 eth0

When i add the gateway manually route add tun0 i'm able to ping the VPN server. I still cannot ping the servers (e.g. When i check routel, i notice that the a route to is missing.

root@somedevice:/home/pi# routel
         target            gateway          source    proto    scope    dev tbl
        default     dhcp            eth0                                                 link   tun0                   kernel     link   tun0 24               dhcp     link   eth0              local   kernel     host   tun0 local          broadcast   kernel     link   eth0 local              local   kernel     host   eth0 local          broadcast   kernel     link   eth0 local          broadcast   kernel     link     lo local 8            local   kernel     host     lo local              local   kernel     host     lo local          broadcast   kernel     link     lo local
            ::1                                      kernel              lo
        fe80::/ 64                                   kernel            eth0
        fe80::/ 64                                   kernel            tun0
            ::1              local                   kernel              lo local
fe80::65cf:ce3:fc9f:20fa              local                   kernel            eth0 local
fe80::c648:ccba:8f47:86b7              local                   kernel            tun0 local
        ff00::/ 8                                                      eth0 local
        ff00::/ 8                                                      tun0 local

When i add this route manually ip route add via i can ping the servers (e.g. :-D


  • How can i push the correct gateway ( instead of to the clients with DHCP addresses?
  • How can i push the route via to the clients with DHCP addresses?

I thought it was done with

push "route-gateway"
push "route"

but that doesn't work, what i'm doing wrong?

----------- UPDATE -----------

I just noticed that push "route-gateway" and push "route" pushes the gateway/route to the "static server clients" but not to the clients that receive their VPN IP via DHCP. Why are they not also applied to the DHCP clients?

1 Answer 1


For my clients (with dhcp ips) working

port 53
proto udp
dev tun

ca …
cert …
dh …

cipher …
auth …

local …

max-clients 253
topology subnet
keepalive 10 120
comp-lzo no
push "comp-lzo no"
user nobody
group nogroup
push "dhcp-option DNS"
push "dhcp-option DNS"

push "redirect-gateway def1"
push "route 1"


push "route net_gateway 1"

to use default client’s gateway.

  • username-as-common-name and tls-server are absolutely redundant. The first is useless when you don't use scripts of plugins, and second one is already contained within server .... In the vast majority of cases, you don't need local ... too. port 53 will not work if there is a DNS service on the same machine; I suggest not to invent murtky schemens and use recommended port 1194. Also I'd not specify auth and cipher for it to be able to negotiate best security parameters. To increase security, tls-auth or tls-crypt might be added. Sep 26, 2022 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.