Config for LAN Tunneling only

itsmaxdd

Hello OpenVPN community,
i hope this is the right place. I know someone already asked this but to me the forum is pretty crowded with all kind of posts and it's quite hard to define proper keywords to find what i need

Currently im running an OpenVPN server at my first home, the reason is to share my samba hdds and services as i if was locally.
I'm using a *.ovpn profile which is the one below

client
dev tun
proto udp
remote myip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1 
cipher AES-256-CBC
comp-lzo
verb 3
mute 20

...

What i noticed with the tutorial i followed is that even my WAN (internet traffic, online games) is routed through the VPN server (i'm assuming that because my ip on the various sites is the same of the one of my first home). Basically what i am looking for is a Split tunnel (is it correct?). Now i think the client is able to decide what should pass in the VPN and what not but i can't find a proper way to allow only my LAN traffic through it.

Hope to be clear,
Thank you

itsmaxdd

Sorry for the double post, below my server cfg

local 192.168.1.19 # YOUR PI'S IP ADDRESS
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/OC1HS.crt
key /etc/openvpn/easy-rsa/keys/OC1HS.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.0 255.255.255.0" # YOUR PI'S IP SUBNET
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 8.8.8.8" # YOUR ROUTER'S IP ADDRESS
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
[color=#80FF00]push "redirect-gateway def1"[/color]
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 3

Is it due to the highlighted command?

Traffic

The Pi tutorial you followed is [...]

Delete these:

itsmaxdd wrote# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"

They are set automatically.

Delete this:

itsmaxdd wrotepush "redirect-gateway def1"

It is used to tunnel ALL your client data.

itsmaxdd wroteserver cfg

Code:
local 192.168.1.19

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

Also, ensure IP forwarding is enabled on your server.

To connect to Network Shares:

> net use x: \\windows.host.ip.address\sharename

itsmaxdd

Thank you for your reply, is there a way do enable and disable the WAN tunneling from the client ? without restarting the server?

itsmaxdd

Can i use --route-nopull as reported in https://community.openvpn.net/openvpn/wiki/IgnoreRedirectGateway

Traffic

I would setup two different client configs with two different certs .. one with redirect and one without.
Then select which one you require from the client machine.

itsmaxdd

So a config with no-pull and a config without?

Traffic

No .. Use the --client-config-dir on the server to setup two different client profiles to push to the client.
See --client-config-dir in The Manual v23x

See these HOWTOs:

HOWTO: Expanding the scope of the VPN to include additional machines
This explains how to setup different client profiles on the server. (You do not need the --iroute for this)
HOWTO: Routing all client traffic (including web-traffic) through the VPN
This explains how to use --redirect-gateway (which you already understand somewhat).

Just imagine you are setting up a VPN server for you and your friend .. one with --redirect-gateway one without.

itsmaxdd

So i use two different server configs based on which client is requesting the connection?