How to use "redirect-private" option in server.conf?

BobAGI

I am struggling to configure an OpenVPN 2.4.0 server on Raspberry Pi such that it will accept client connections that will reach into the remote LAN where the server is running but NOT use the Internet gateway on that LAN.
What I have now is perfectly OK except for the fact that it sends the Internet traffic through the tunnel, which we want to avoid.

The Internet should be reached via the client's own gateway so that no Internet directed traffic passes the VPN tunnel.
In most tutorials they talk about the opposite situation, that all of the client traffic should go through the tunnel and then an option like this is put into the server.conf file:
push "redirect-gateway def1 bypass-dhcp"

With this my client can connect to the VPN and access the remote LAN resources but his Internet traffic is also routed that way, which I want to avoid.
But simply comment away that option does not solve the problem, instead the client now has no Internet access at all. Only access to his own local network plus the remote local network. Not good.

Now I have found a new option I did not know existed, it is mentioned in the OpenVPN 2.4 man pages as follows (my underline):

--redirect-private [flags]
Like --redirect-gateway, but omit actually changing the default gateway. Useful when pushing private subnets.

Unfortunately I have not found any examples with this option so I have no idea how to set the flags for my case...
I know it is available also on OpenVPN 2.3 too but is there some version requirement on the client side for it to work?
On Windows I am running OpenVPN-GUI v 11.9.0.0 and on Android OpenVPN-Connect version 1.1.17

Can someone please direct me to an instruction page or tell me exactly how this option should be set?

TinCanTech

HOWTO: Expanding the scope of the VPN to include additional machines

BobAGI

BobAGI wrote When I deactivate the redirect gateway in the server config then the client has access to the remote LAN computers but stalls on access to the Internet. Everything times out....
So the client side gateway seems to have been switched off....
My tests are done with the client on an Android phone and the server on a Raspberry Pi3 running Raspbian Stretch.
...
Since the client is on a phone I cannot examine its routing table or even its IP address or gateway address like if it was a regular PC...

Turns out that my problem was that I used an Android phone as the test client!
Today I could test on a Windows7 PC connected to a different LAN and now it works as expected.
Without the redirect-gateway setting the client will use its normal Internet connection but with redirect.gateway activated Internet travels through the tunnel. Exactly what I was struggling to accomplish over the week-end.

So apparently the app OpenVPN-Connect on Android is not able to run a split tunnel....

TinCanTech

I know of no reason that OpenVPN-Connect on Android cannot do a split tunnel .. all that is pushed are routes.

BobAGI

Well here are my config files, maybe you can spot something.
With these I can connect and view remote LAN resources while the web access goes through the client gateway.
But only on my Win7 PC, when I try on my Samsung S4Mini and S7 phones web browsing is not working at all.

# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d

# Which TCP/UDP port should OpenVPN listen on?
port 1198

# TCP or UDP server?
;proto tcp
proto udp

;dev tap
dev tun

# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/AGIVPN.crt
key /etc/openvpn/easy-rsa/keys/AGIVPN.key # This file should be kept secret

# Diffie hellman parameters.
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

topology subnet

server 10.8.1.0 255.255.255.0

ifconfig-pool-persist ipp2.txt

#Bosse home local network
push "route 192.168.119.0 255.255.255.0"

;push "redirect-gateway def1 bypass-dhcp"
push "redirect-private"

# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"

;duplicate-cn

keepalive 10 120

# The second parameter should be '0'
# on the server and '1' on the clients.
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 # This file is secret
cipher AES-256-CBC

# For compression compatible with older clients use comp-lzo
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo

max-clients 20

user openvpn
group nogroup

persist-key
persist-tun

status /etc/openvpn/log/openvpn-status2.log

;log openvpn.log
log-append /etc/openvpn/log/openvpn2.log

verb 3

;mute 20

# Notify the client that when the server restarts so it
# can automatically reconnect.
explicit-exit-notify 1

client
dev tun
proto udp
remote home.xxxx.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
remote-cert-tls server
#ns-cert-type server
key-direction 1
#auth SHA512
cipher AES-256-CBC
comp-lzo
verb 1
mute 20
<ca>
-----BEGIN CERTIFICATE-----
MIIE2TCCA8GgAwIBAgIJAJMTJXcJkGNdMA0GCSqGSIb3DQEBCwUAMIGjMQswCQYD
89FvrhLAXczJQPduQj5GhL+cWb4XemFm3tiaC2stCgMF6i9d9bSKgxQYmySS
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIFNDCCBBygAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBozELMAkGA1UEBhMCVVMx
...
6LgPwwBd2imqJS2NmY/HZkur4gH/f/XD8Mac2pZrcKhsVVS2YB9aFg==
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,DCE114A8BB614F48

H+8YNHMHgC12ypLJf5ClcjhFdqHqsB0ererKtoeBoWPbtkH2DnbKfzug4k/fdX30
...
1HoVHYbpZ5BGbqKXq0DiSKsIWY0zBzXgPJVSlwH+enJ00othBB3HNFvFgsk8GVCs
-----END RSA PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
8fe4da3d17700799bcaf37db4305be1d
...
3b44895127e04c931dc20cd106e7ea10
-----END OpenVPN Static key V1-----
</tls-auth>

BobAGI

I searched for redirect-private on that page and it is not mentioned once...
However, my base problem regarding split tunnels is already solved (see other threads) so I guess I don't need to dig deeper into this...

TinCanTech

BobAGI wrote I searched for redirect-private on that page and it is not mentioned once...

Because that is not what you need .. you need redirect-gateway as described.

If you randomly change directives then expect random behaviour ...