Windows 2012 Server has two network interfaces. One with static IPv4 configuration and a TAP adapter which is activated when this server connects to remote OpenVPN server.

Physical NIC, which is used by this server to communicate with Internet, has usual IPv4 settings (address,mask,default gateway, dns).

Once connection with remote OpenVPN server is established, ip address is assigned via DHCP on TAP interface and I can communicate with OpenVPN's ip

However, if I try to add route to a network behind OpenVPN server, Windows ignores it - tracert shows that packets to hosts in this network go through default gateway.

This is the routing table with VPN connection established.

IPv4 Route Table
Active Routes:
Network Destination      Netmask        Gateway       Interface  Metric     11        20  On-link   266  On-link   266  On-link   266        On-link       306  On-link       306  On-link       306        21        On-link       306        On-link       276        On-link   266  On-link       306  On-link       276  On-link   266
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric

(I changed first two octets of ISP network to 100.100)

Communications between this server ( and OpenVPN server ( are working fine. As you can see, there is a route to network via gateway which is available through local address

I add this route like this:

route add mask

However, tracing host in network shows that packets are sent through default route to Internet Provider instead of being routed through gateway

C:\Users\user1>tracert -d
Tracing route to over a maximum of 30 hops

  1    2 ms    2 ms    5 ms
  2   <1 ms   <1 ms    2 ms
  3    3 ms    5 ms    2 ms

What am I missing?

  • Why is the gateway for not On-link instead of
    – Ron Maupin
    Dec 4 '19 at 23:15
  • 1
    Your gateway should be If you want things to be simpler you probably should be using the subnet topology on the openvpn server, not net30. Look closely at your other route
    – Zoredache
    Dec 4 '19 at 23:58
  • Thank you very much. I was not even aware about legacy net30 topology. For now routing through works, I'll move to topology subnet in nearest future. Could you please make it an answer so I can accept it? Dec 5 '19 at 4:55
  • @Zoredache, could you please make your comment an answer so I can accept it? Dec 6 '19 at 8:28

As @Zoredache stated in comments, my openvpn server had the topology net30 option, so route through vpn server should be configured through address, not On-link address on TAP interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.