1

I have an OpenVPN setup running fine. The problem is one of my systems that connects I don't want it to run all traffic through OpenVPN. That single system I want it to only run the VPN IPs through the VPN and all other network requests through my normal ISP.

My server.conf file has this for pushing Gateway and DNS settings through:

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

This works perfect for all but one unit connecting. That one single unit I only want to have access to the VPN IP range, not send all network traffic through the VPN.

I have tried this to connect to the VPN without routing all traffic:

sudo openvpn --remote IP --comp-lzo --dev tun --auth-user-pass ovpn.txt --ca ca1.crt --client --route-nopull

This works fine. The problem is, though my internet is not routed I now cannot access the VPN IP range of 10.0.0.0/24.

So my question is, how do I disable internet traffic routing but allow VPN IP routing for one single client while enabling it for all others?

1

redirect-gateway is meant to tell the client to send all traffic through to the server. It redirects your default gateway through the VPN.

If you want to disable it for one client, you can put the following in the client config to override redirect-gateway:

route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway

Source: OpenVPN.net

5
  • Ok that's great, but I wanted to do it at runtime/command run since there are "some" times I want to be able to allow it and other times I don't. I don't want to have to edit a config file each time. – jfreak53 Apr 23 '15 at 18:18
  • 1
    Make a second config file other than your default, and call it when you need your gateway back. – Hyppy Apr 23 '15 at 18:22
  • Great idea, thanks! Problem is, when I put those lines in my config1 file I still cannot ping 10.0.0.1. I get a timeout. So it still doesn't work. – jfreak53 Apr 23 '15 at 18:28
  • Nevermind! Sorry, it did work. I had to remove the nopull option while doing this. – jfreak53 Apr 23 '15 at 18:29
  • 1
    Yep, what nopull does is ignore ALL advertised routes; both the default gateway and the (quite necessary) VPN routes. – Hyppy Apr 23 '15 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.