I'm using OpenVPN Connect on Windows 10 to access my company's network. I have no control whatsoever on the OpenVPN server.

It appears that right now, all traffic goes through the VPN connection when I'm connected. I'd like some of the traffic (i.e. to public access resources) to not go through the VPN.

Is this possible at all with OpenVPN on Windows?

If so, is that something that needs to be adjusted in Windows itself or in the OpenVPN client?

  • 2
    Your connection settings are determined by the server/client config, in general. If you are an admin on your client machine, you can, of course, change the routing/config to only route the company network through VPN. Be careful, you could also break company policy if this is not your own device. – Lenniey Jan 11 '18 at 17:09
  • @Lenniey Thanks for the information. It's my own device and I'm absolutely an admin on it. Could you point me to some docs regarding how to adjust routing? Everything I find is about OpenVPN on Linux and I'm not sure how to map this to Windows. – François Beaune Jan 11 '18 at 17:26
  • And the server is also yours? – Ondřej Xicht Světlík Jan 12 '18 at 9:02
  • @OndřejXichtSvětlík The server is my company's. I have no control over it. – François Beaune Jan 12 '18 at 13:02

Your server config will probably have something along the lines of this:

push "route"
push "redirect-gateway"
push "route"

When connected to your OpenVPN server, you can check your routes via command line and route print.

So, you got some options, as you are an admin on your device.

  1. Use route-nopull:

When used with --client or --pull, accept options pushed by server EXCEPT for routes.

When used on the client, this option effectively bars the server from adding routes to the client's routing table, however note that this option still allows the server to set the TCP/IP properties of the client's TUN/TAP interface.

  1. Use route-noexec:

Don't add or remove routes automatically. Instead pass routes to --route-up script using environmental variables

  1. Change the routes manually each time you connect (or make them persistent, depends on your usage):

route CHANGE MASK <your preferred gateway> METRIC n1 IF n2

route ADD x.x.x.x MASK y.y.y.y z.z.z.z

where x.x.x.x is your company-subnet, y.y.y.y the netmask and z.z.z.z is your VPN-gatewayserver. n1/2 depend on your configuration, if you even need them.

  1. Ask your network/VPN admin to change your config (or everyone's config) to not route everything through the VPN. This is my favorite, because you dont' have to meddle with client configs etc.

These points are not everything you can do, but it should be enough.

Detailed reading can be done in the official documentation.

This is an example, of course. So you have to adapt to your configuration.

  • Thanks for the detailed overview of my options. Regarding options 1 and 2, I have no idea what route-nopull and route-noexec are. Are they command line tools? Commands that go in the .ovpn file? – François Beaune Jan 12 '18 at 14:03
  • They are for your .ovpn client configuration. – Lenniey Jan 12 '18 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.