Flows to server through VPN tunnel

vgr

Hello.
I configured my Openvpn Serverf and clients, and it works fine.
All my flows to internet go through the tunnel, except flows to my server.

The client routing table is the following :

default via 10.8.0.5 dev tun0  proto static  metric 50 
default via 10.2.0.1 dev wlo1  proto static  metric 600 
10.0.0.1 via 10.2.0.1 dev wlo1  proto dhcp  metric 600 
10.2.0.0/16 dev wlo1  proto kernel  scope link  src 10.2.170.27  metric 600 
10.8.0.1 via 10.8.0.5 dev tun0  proto static  metric 50 
10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6  metric 50 
<my_server_ip> via 10.2.0.1 dev wlo1  proto static  metric 600 
169.254.0.0/16 dev tun0  scope link  metric 1000

So we can see that the flows to my_server_IP are sent throught the wireless interface (wl0)
I tried to add a route in the server configuration

push "route <my_server_ip> 255.255.255.255"

but it is not take in account on the client.

Could you give me the good configuration to send the flows to mly server through the server after the tunnel creation ?
Thanks in advance.
Regards.
VGR.

TinCanTech

vgr wrote we can see that the flows to my_server_IP are sent throught the wireless interface (wl0)

vgr wrote <my_server_ip> via 10.2.0.1 dev wlo1 proto static metric 600

That is how it works ..

The Manual wrote--redirect-gateway flags...
Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN. This is a client-side option.

This option performs three steps:

(1) Create a static route for the --remote address which forwards to the pre-existing default gateway. This is done so that (3) will not create a routing loop.

See --redirect-gateway in The Manual v24x

vgr

Thanks for your reply.
I have this line in my server configuration :

push "redirect-gateway def1 bypass-dhcp"

Is it not the good configuration ?
Thanks
Regards

TinCanTech

You cannot do what you are trying to do because that is not how Openvpn works.

vgr

I understand.
Is there a way to modify /etc/hosts of the client from the server configuration (the aim is the client will obtain resolution of url to the tunnel server ip address) ? I would like to avoid run a named service on my server.
Thanks

TinCanTech

If you use --redirect-gateway def1 then the only way to connect to the public IP of your server but going through the tunnel is with Policy based routing. Otherwise the public IP of the server is always routed via the client default gateway.

IE: https://forums.openvpn.net/posting.php?mode=reply&f=6&t=26001#pr77380

vgr

Thanks.
I will test to use the server tunnel IP address on the client to go through the tunnel to access server ressources/services.
Regards.