I have a router with IP subnetting

On that subnet, a Synology NAS has an IP of and is running a VPN server using subnet

When I connect a client to that server from outside both networks, I get assigned From that client I can ping machines on ( & for example) and &

From machines already on, I can ping the VPN client ( after adding a static route of route add mask (windows).

Before adding the redirect-gateway line to the client config, I would be able to access the internet while on the VPN but was unable to access local web services like a router service or the Synology NAS web service (running within I thought this was maybe because the external IP (whatmyip.org) from a VPN client showed the same external address as if I was not connected to the VPN.

After adding the redirect-gateway line to the client config, I verified I had the correct external IP (matches the clients external IP) when connected but could not access external sites (google.com) but could access internal web services ('s &'s).

What am I missing?

Weird observation, not sure why but the client ( gets a DHCP & gateway server of which as far as I know, isn't anything that exists. I can't ping it. is definitely the VPN server and I can access it's web service ( on

Connected client ipconfig /all:

Description . . . . . . . . . . . : TAP-Windows Adapter V9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . :
Subnet Mask . . . . . . . . . . . :
Lease Obtained. . . . . . . . . . : Thursday, August 13, 2015 11:55:43 AM
Lease Expires . . . . . . . . . . : Friday, August 12, 2016 11:55:42 AM
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . :
DNS Servers . . . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Enabled

2 Answers 2


You must make sure your router has an outbound NAT entry for the VPN network and that DNS has been set.

See this: https://openvpn.net/index.php/open-source/documentation/howto.html

You must redirect the gateway: push "redirect-gateway def1"

Make sure the client has DNS set or push it with openVPN using push "dhcp-option DNS x.x.x.x"

The final step as mentioned above is that your router must have outbound NAT configured for your VPN network, otherwise you won't get out onto the internet.

  • How does the push "redirect-gateway def1" ? What is def1? I fiddled with dhcp-option DNS in the client config. Not sure which DNS address I should be pointing to though.
    – Enigma
    Aug 13, 2015 at 16:08
  • 1
    From the OpenVPN docs "def1 -- Use this flag to override the default gateway by using and rather than This has the benefit of overriding but not wiping out the original default gateway." You can choose any DNS you want, public or internal. Have you checked out the NAT on your router? Aug 13, 2015 at 16:15
  • That's a pretty huge howto link. Are there particular parts you could point me to that could help me set up an oubound NAT? Searched for outbound and got nothing.
    – Enigma
    Aug 13, 2015 at 16:15
  • Outbound NAT has nothing to do with OpenVPN itself, it is a feature of IP networking that allows a router to translate addresses on one network, to an address on another. It will be a configuration option on your router somewhere and you must tell it to NAT your VPN range to your public IP. Be warned though, I have never seen an option to add additional outbound NAT set ups in any 'domestic/home' routers I have used. Aug 13, 2015 at 16:18
  • So is the idea that http requests coming from will get redirected to an IP on ? Hmm... So I have a farily new model of a verizon router but it is still very much a domestic/home router. It has static routing capabilities though.
    – Enigma
    Aug 13, 2015 at 16:22

Two main issues:

  1. you've already discovered and that's the return route. This needs to be added to not just one system, but also your router.

  2. you may need to also add a second internal network to your NAT list.

Another option would be to configure the Synology to NAT the VPN traffic inside the network so traffic for public internet appears to come from the synology, but you will not be able to easily access services on the VPN IPs from your LAN. Specify your router brand, or if possible move your OpenVPN config to the router for simpler setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.