Routing All Traffics to VPN Not Working

csl

I am trying to route all traffic from/to the client through the VPN server, but it does not work.
Yes, I provided this line to server.conf.
push "redirect-gateway bypass-dhcp"

However, when the client connects to the server, it automatically adds "def1" flag to the redirect-gateway option.

Tue Jul 30 14:46:21 2019 PUSH: Received control message: 'PUSH_REPLY,route 10.1.0.0 255.255.255.0,redirect-gateway bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
Tue Jul 30 14:46:21 2019 Flag 'def1' added to --redirect-gateway (iservice is in use)

The "route print" results on the client show that the client still holds the existing route tables even after the VPN connection. I am assuming this is because the client added "def1" flag, which leaves the existing gateway intact.
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

--redirect-gateway flags...
Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN. This is a client-side option.
This option performs three steps:
(1) Create a static route for the --remote address which forwards to the pre-existing default gateway. This is done so that (3) will not create a routing loop.
(2) Delete the default gateway route.
(3) Set the new default gateway to be the VPN endpoint address (derived either from --route-gateway or the second parameter to --ifconfig when --dev tun is specified).
When the tunnel is torn down, all of the above steps are reversed so that the original default route is restored.
Option flags:
def1 -- Use this flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway.

What is wrong with server.conf?
What is "iservice" in the log doing?

[Server]

Ubuntu 18.04 LTS

OpenVPN 2.4.4

[Client]

Windows 10 Pro 64bit

OpenVPN GUI 2.4.7

PS: I am posting a much shorter question than what it should be because the forum system rejects my post claiming it's a spam.

TinCanTech

csl wrote Flag 'def1' added to --redirect-gateway (iservice is in use)

iservice is the Openvpn Interactive service for Windows and it deliberately adds def1 to redirect-gateway because that is the right way to do this.

If you don't want def1 then do not use the interactive service.

csl wrote I am posting a much shorter question than what it should be because the forum system rejects my post claiming it's a spam

Sorry about that, our anti-spam is very sensitive, possibly over sensitive ..

csl

Thank you for your reply @TinCanTeck

I did research and found that the following workaround works.
- Add "route-method exe" directive in the Windows client config file
- Execute the Windows GUI client as an Administrator

I am not sure why the Windows client needs iservice while adding "def1" flag (when executed as usual), but the above method seems let the client remove the existing routing tables for the Internet connections.

TinCanTech

csl wrote I did research and found that the following workaround works.
- Add "route-method exe" directive in the Windows client config file
- Execute the Windows GUI client as an Administrator

These are both absolutely terrible ideas and you ought not use them.

But if you just don't care about your security then do what ever the &^%$ you please.

We do have some instructions for beginners on howto use the GUI:
https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New

csl

Why are they terrible ideas??
I'm just curious why (I could not find a clue in the link above).

TinCanTech

There is no reason to use openvpn while logged in as an administrator.
Openvpn has been written to explicitly function correctly for normal users.
Openvpn "interactive service" does not require use of exe to manage routes.
This is a good security policy.

csl

Thanks for your reply @TinCanTeck.
I understood your point.
I am doing this just for the testing purpose. So it is not an issue in my specific case.

csl

Oh, forgot to mention.
Understood using interactive service is the better way!