I am managing three distinct geographical sites which I would like to connect using a central OpenVPN server.

My idea would be to have a network device on each location connect to the OpenVPN server and route specific network traffic through it. I have already split the subnets (,, ) so that each location gets a distinct private subnet.

However, it is not clear to me what the networking setup should look like. My first guess would be:

OpenVPN server:

  • has IPV4 forwarding enabled
  • routes to Site A VPN client
  • routes to Site B VPN client
  • routes to Site C VPN client

Site A VPN Client:

  • has IPV4 forwarding enabled
  • routes to internal network
  • routes to OpenVPN Server
  • routes to OpenVPN server

(Site B and C VPN clients are similar)

Is that a correct way of approaching the issue? Am I missing anything in terms of functionality/security when doing this?


I've based my setup on the following guide: Lans behind OpenVPN.

The first change needed was to enable the client-config-dir setting in my server's configuration

client-config-dir ccd

In that directory, for the site A VPN client I marked it as the internal owner of that route


Then, I switched to a subnet topology ( still not the default ), defined and pushed the internal routes to all the clients:

topology subnet
push "route vpn_gateway 1000"

I specifically set a higher metric for the VPN route ( 1000 ) so that devices connected to that network directly do not use it. At least on my local workstation the default metrics are 100 for ethernet and 600 for wireless, so the VPN is used only if none of those are present.

Of course, ipv4 forwarding is enabled on the network devices.

With that being done, all is working as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.