I setup my OpenVPN server a few months back using the redirect-gateway def1 option to configure all traffic from a client to traverse the OpenVPN server. Since the server was originally set up we no longer want this behavior and want to only have traffic destined for a specific subnet traverse the OpenVPN connection.
To accomplish I thought all i would need to do is:
1) added the push route statements for the appropriate subnets
2) commented out the push redirect-gateway lines
After changing our configuration and restarting the openvpn daemon I am still getting my default route on clients changed to flow through OpenVPN. I looked around and from what I've read/gathered from other forum posts removing the redirect-gateway line should stop the default route(s) from going out. Am I missing something? How can I stop these routes from going out?
Routes I don't want added:
0.0.0.0 128.0.0.0 192.168.206.5 192.168.206.6 30
128.0.0.0 128.0.0.0 192.168.206.5 192.168.206.6 30
Client Received control message (I believe "route 192.168.206.1 is" in the server's PUSH line is the culprit):
Sun Oct 14 01:46:17 2012 PUSH: Received control message: 'PUSH_REPLY,route 192.168.192.0 255.255.240.0,,dhcp-option DNS 192.168.195.10,dhcp-option DNS 192.168.195.11,dhcp-option DOMAIN sea1.office.priv,route 192.168.206.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.206.6 192.168.206.5'
Server config:
local 0.0.0.0
port 1194
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/certs/server.key # This file should be kept secret
dh /etc/openvpn/certs/dh1024.pem
server 192.168.206.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.192.0 255.255.240.0"
push "dhcp-option DNS 192.168.195.10"
push "dhcp-option DNS 192.168.195.11"
push "dhcp-option DOMAIN mydomain.com"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/openvpn-ldap.config
tmp-dir /tmp
reneg-sec 0
client config:
client
dev tun
proto udp
remote myvpn-server.mydomain.com 1194
remote-random
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert USER.crt
key USER.key
ns-cert-type server
comp-lzo
verb 3
auth-user-pass
