Use policy based routing .. but that is quite complicated. (google: linux policy based routing)
The client sides are both Mac, Windows, linux, and phones. Are you referring to some policy route that I would push to the client from the server? Or are you thinking about a complex policy based routing one would craft for each of the clients individually? I do not see any way to do this generically for all OSs and the 'mark' option only works on Linux, so I'm sorry to report that I'm skeptical about this as a solution here.
I see and understand what's going on. I'd like to point out that it's not obvious that such traffic doesn't get pushed down the VPN! Unless you're someone who goes to the details of looking in log files or tcpdump, it's not obvious this shouldn't work. Imagine a user who downloads openvpn to secure the traffic between their laptop or desktop and their server, they install it and get it working with redirect-gateway, do some basic testing like asking google "what's my ip address" and it looks like it's working, however, the most important traffic to their server--their email for example--goes out in the clear! My point here is that this issue is perhaps just a wee bit more serious than one might otherwise think.
From memory (and I admit that it's been years since I have played with this), I think there's a way to bind before connect which forces a connection to use a specific interface, then, you set the routing such that everything goes into the VPN (hence no /32 in this case to surgically remove packets going to the openvpn server needed), but the bound connection still uses the original interface. Does this work? Would this solve this problem and make things more secure? I'd actually have to set up a test to see if that works for both tcp and udp. On second thought, even if this works it would only partly solve the problem because any connections currently bound going to the server like an imap connection would continue to go out of the real interface and not be routed into the VPN interface.
Is there some other way to fix this behavior or is this really an insurmountable problem that requires the use of the VPN address (the 10.8.0.1 address in my example)?
Again, just want to point out that you might think it's easy for some people to just use this VPN address but that's not always the case, particularly when things like https are involved or when the VPN is used in only certain cases like when outside the office or home. I can't be the only one who has come across this! Setting up thing like split DNS isn't exactly easy either.
