20

I need configure my openvpn server to provide some LAN resources, but I don't want route all traffic for my clients.

Here is my sample network description: My LAN is 192.168.1.0/24. Openvpn network is 192.168.100.0/24. I add push route 192.168.1.0 255.255.255.0 in my server side configuration. I would like to allow my clients can access 192.168.1.0/24, but not other traffic.

How can I do this from server side configuration? Is client side configuration the only way to do this?

Improve this question

7 Answers 7

Reset to default
19

Simply do not add the redirect-gateway in the client or server configuration and the default gateway will not be changed.

Improve this answer
4
  • 11
    There is no redirect-gateway in server configuration. Maybe I missed something?
    – Solomon
    Commented Jul 16, 2012 at 16:32
  • 4
    Did you check on the client side as well? The option can be set on either side. Watch your OpenVPN log on the client when the connection is being established. You should see messages about the gateway being switched, and if the option was pushed from the server or not.
    – Zoredache
    Commented Jul 16, 2012 at 16:33
  • 1
    I use NetworkManager for convenience and get confusion. It works with new client side configuration and without NetworkManager. Thanks.
    – Solomon
    Commented Jul 16, 2012 at 16:57
  • @Solomon There might be something like push "redirect-gateway def1 bypass-dhcp" in server.conf. (At least in Ubuntu's default setup.) Changing that to push "def1 bypass-dhcp" makes the server not push a default gateway to clients.
    – Supernormal
    Commented Apr 20, 2022 at 14:34
42

This is a client setting.

For Linux clients, in NetworkManager: Edit Connections -> VPN -> (select the vpn configuration you would like to edit) -> Edit -> IPv4/IPv6 -> Routes -> Check the box that says "Use this connection only for resources on its network"

Improve this answer
2
  • 3
    is there any way to make this the default in the configuration file?
    – Zoltán
    Commented Sep 20, 2018 at 8:03
  • It can also be a server setting. See @Zoredache's answer.
    – Supernormal
    Commented Apr 20, 2022 at 14:35
9

Due to I have ipv4 and ipv6, if I don't want openvpn to set my default gw, I had to add the following lines at my client configuration, and I had to add manually the ipv6 routes:

pull-filter ignore "route-gateway"
route-nopull

If I don't want all the ipv4 traffic necessarily going through my openvpn interface, I had to add only the following line

pull-filter ignore "route-gateway"

The line above would make that my traffic to hosts supporting ipv4 and pv6 will be going through my openvpn connection, while my traffic to hosts with only ipv4 will be going through my wireless interface.

My original client configuration before playing was:

client
dev tun
proto udp
remote ovpn.myserver.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
verb 3

Regards,

Improve this answer
6

route-nopull in the .ovpn file, or --route-nopull on the command line.

You'll then have to set up the routes yourself, of course.

Improve this answer
3

I found that removing

resolv-retry infinite

from my client.conf stops pushing default route from server.

Improve this answer
1
  • Thanks. This solved the problem for me.
    – Rob Allen
    Commented Nov 25, 2019 at 16:55
1

(For clients)

--pull-filter ignore "<the beginning of the command, which sets the route>"

To get the exact command, which server pushes, you must:

  • enable logging with verb 7 either in the config, or via command line;
  • wipe the log to see clearer, echo >/var/log/<whatever you named it>.log;
  • start openvpn;
  • in the log search for route or gateway;
  • add the command in the line with pull-filter ignore.

The command may look like redirect-gateway def1.

Improve this answer
1

Try adding pull-filter ignore "route-gateway" to you .ovpn file. Then, remember to set your custom routes.

Example:

...
pull-filter ignore "route-gateway"
route-method exe
route-delay 2
allow-pull-fqdn
route <some subnet IP> <subnet mask> <gateway IP>
route <other subnet IP> <subnet mask> <gateway IP>
...

NOTE:
It works when launching vpn connection from shell:

sudo openvpn --config /home/sfernandez/Documentos/config/sfernandez.ovpn

For work stations, if you are going to use .ovpn file for importing configuration to create a new connection:

sudo nmcli connection import file /path/to/your/file/vpn_config.ovpn type openvpn

Then, you'll need to set this option in your UI connection manager. Something like:

IPv4 Settings -> Routes -> [x] Use this connection only for resources on your network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .