Configuring OpenVPN to route only selected traffic.

sniperkitten

Hello!

Please help me to setup OpenVPN.
My goal is to configure OpenVPN, so traffic only to selected subnets goes through VPN.

I already installed and tested OpenVPN on Ubuntu 16.04 and using Windows 10 client.
I used following script for configuration: https://github.com/Nyr/openvpn-install

It works successfully when I use those two options:

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 213.133.98.98"

But then I tried reconfiguration: removed above two lines and added this line instead:

push "route xx.xx.xx.176 255.255.255.240"

After connection to VPN I'm able to ping public IP addresses like 8.8.8.8.

1) But DNS requests on Windows 10 client laptop doesn't work anymore:

Address: 8.8.4.4
DNS request timed out.

2) Moreover, hosts of xx.xx.xx.176 network are not pingable anymore from Windows client

Thank you!

sniperkitten

Here's server server.conf contents:
-------------
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route xx.xx.xx.176 255.255.255.240"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
---------

Here's client config:
------------
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote xx.xx.xx.179 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3
----------

sniperkitten

Ok, was able to resolve it by myself:

Need to comment following setting in following file, used as a template for all client configs:

/etc/openvpn/client-common.txt

#setenv opt block-outside-dns

Also modified installation script:

echo "client
dev tun
proto $PROTOCOL
sndbuf 0
rcvbuf 0
remote $IP $PORT
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
#setenv opt block-outside-dns
key-direction 1
verb 3" > /etc/openvpn/client-common.txt

As we don’t use gateway redirection, we need client dns to be enabled. Only selected traffic will go to VPN server.

Modify server configuration file
Comment following directives in /etc/openvpn/server.conf, because we will not forward all traffic through dns

#push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 8.8.8.8"

Add routes to OpenVPN server config

push "route xx.xx.xx.176 255.255.255.240 vpn_gateway"
push "route xx.xx.xx.179 255.255.255.255 net_gateway"

Second route required, because xx.xx.xx.179 is address of VPN server itself. If we route it also via vpn_gateway 10.8.0.1, it will not work. So this particular address needs to be excluded.