[Solved] Can't setup selective routing

angc

I am running a VPN server on Ubuntu 16.04, and VPN client on Windows 10. I am not sure if it's significant but the traffic is going through STunnel.

By default all the traffic is going through the VPN and it works fine, but I want only some destination IP to go through it, the rest should go through my normal network. I tried following the online guides, but I end up unable to connect with anything.

I initially tried to configure the VPN to capture nothing, and thought I would add routes one by one, but even this way I can't connect at all.
(And yes, I am running OpenVPN's GUI in admin mode)

My config:

port 1194
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 213.186.33.99"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

route-nopull
#route 104.16.154.36
dhcp-option DNS 8.8.8.8
dhcp-option DNS 8.8.4.4
client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote localhost 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
[oconf]

angc

So, I realized that, when connected to the VPN with the configuration above, I can ping an IP address directly. Looking into the logs, I found this line that happens every time I connect:

Blocking outside dns using service succeeded.

However, neither the server nor the client have the option "block-outside-dns" set up, so how can I disable this ?

angc

Nevermind, I am actually blind, I realized I had this option written by default in my CLIENT's config:

setenv opt block-outside-dns

Believe me or not but I did search that config file for this specific option, but I didn't see it ...

TinCanTech

We all have blind spots 8-) Thanks for updating your thread.

TinCanTech

angc wrote So, I realized that, when connected to the VPN with the configuration above, I can ping an IP address directly. Looking into the logs, I found this line that happens every time I connect:
Blocking outside dns using service succeeded.

You are pushing valid DNS servers and so this is what you want..