I am trying to enable split tunneling with my VPN network. I am using OpenVPN to host my VPN network and have follwed the steps to get split tunneling working however my clients still get the: {VPN local address} push

Here is my server.conf file on the OpenVPN server, which has a real public interface with a real IP.

port 1194
proto udp
dev tun
#ssl stuff
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/dh2048.pem
#server statement and subnet for VPN IPs /24 for simplicity
ifconfig-pool-persist ipp.txt # for persistant IPing of VPN clients
push "route-nopull"
push "route vpn_gateway" #internal node i want VPN clients to have access to
push "route vpn_gateway" #internal node I want VPN clients to have access to
push "dhcp-option DNS" # so VPN clients use internal dns for resolution
[rest of config omitted]

Client's Route table where: is the client's VPN address {publicIP} = is the public IP of the client's network {localIP} = is the localIP such as 192.168.x.x of the local network it is on, not the VPN.

Destination      Gateway        Genmask         Flags         UG
{publicIP}       {localIP} UGH   Ug UH   # don't really understand this statement UGH  #from push command in server.conf UGH  #from push command in server.conf
{client's localSubnet}   U

IPTables on the OpenVPN box, this box has the public interface used to accept incoming OpenVPN requests.

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --          /* Allow VPN IPs to connect to the internal DNS for resolution */
ACCEPT     all  --         /* Allows VPN IPs to connect to homeserver */

I believe these are the only configs involved with VPN connectivity in my setup. So I am a little confused since my VPN clients recieve the explicity push statements into their route tables, however client's still cannot use their local gateway for IP requests not destined for the or networks..

Thank you for the help and time in advanced.


  • I believe you need Nat rules on the vpn server to Nat between clients and the 172 network – deed02392 Aug 28 '15 at 9:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.