openvpn connect windows client not adding static route

jdratlif

I'm using openvpn to access resources on my home network. I don't want it to route all traffic by default. But I do want to add a specific route from the openvpn server to my local network. If I add the route manually, it works fine. Is there a way I can alter my ovpn config file to make it add the route to the client automatically?

I added this line

route 192.168.1.0 255.255.255.0 10.8.0.1

but it made no difference. It didn't help to run OpenVPN server gui as an admin user either.

Thanks.

300000

you need to add route like this to make it work

route 192.168.1.0 255.255.255.0 vpn_gateway

this way mean that the subnet 192.168.1.0 will use openvpn server as gateway

route 192.168.1.0 255.255.255.0 net_gateway

this way mean that the subnet 192.168.1.0 will not use openvpn server as gateway

try it to see which one work for you.

jdratlif

I don't understand what you mean by vpn_gateway and net_gateway.

If my openvpn server is on 10.8.0.1, and my client gets the IP 10.8.0.2, how would the vpn_gateway not be 10.8.0.1?
The net gateway would seem to be 192.168.1.1, and that doesn't work.

jdratlif

I found a solution.

In the server config, I put
push "route 192.168.1.0 255.255.255.0"

And now it works. I had this in before, but with the gateway specified, and it didn't work. Specifying the gateway somehow confuses it.

TinCanTech

jdratlif wrote Specifying the gateway somehow confuses it

Probably because you specified the wrong gateway ...

jdratlif

What should the gateway be then?

If my openvpn server is on 192.168.1.2, and when I start it, it runs on 10.8.0.1. If the gateway is not 10.8.0.1, what is it supposed to be?
When I leave it out, my route gets put in with the gateway 10.8.0.1, so I'm pretty sure the gateway is 10.8.0.1, which is exactly what I had in there.

TinCanTech

jdratlif wrote What should the gateway be then?

The correct gateway in openvpn is the remote endpoint to the --ifconfig option, from the clients side.

jdratlif

TinCanTech wrote The correct gateway in openvpn is the remote endpoint to the --ifconfig option, from the clients side.

I have no idea what that means. There is no ifconfig option anywhere in my ovpn file. I didn't run openvpn from the command line, I used the windows openvpn connect client.

On the client side, if I do this:

route 192.168.1.0 255.255.255.0 10.8.0.1

it DOES NOT ADD THE ROUTE.

If I do this, on the client side

route 192.168.1.0 255.255.255.0

It does add the route. The windows route shows this

Network Destination Netmask Gateway Interface Metric
192.168.1.0 255.255.255.0 10.8.0.1 5 257

So exactly how you can come to the conclusion that I put in the wrong gateway I do not understand. The configuration does not work when you add the gateway.

The exact same behavior is seen when you put the route on the server and leave it out of the client config
push "route 192.168.1.0 255.255.255.0" works
push "route 192.168.1.0 255.255.255.0 10.8.0.1" does not work

OpenVPN server 2.4.7 on Debian 10
OpenVPN Connect for Windows version 3.1.0 (361)

TinCanTech

Please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

Your client log would be enough.

300000

So exactly how you can come to the conclusion that I put in the wrong gateway I do not understand. The configuration does not work when you add the gateway.

When you added wrong one he know and tell you but you are thinking it is not right , if you add like this , it will correct add gateway to the client

route 192.168.1.0 255.255.255.0 vpn_gateway
push "route 192.168.1.0 255.255.255.0 vpn_gateway"

just try it on the client and server and see it ,why do you think route 192.168.1.0 255.255.255.0 10.8.0.1 is correct way and you are convince this way

that why he said you added the wrong way and he know that is wrong way to add.

jdratlif

I misunderstood you originally 300000. It did not click for me that you meant the literal text "vpn_gateway", not the gateway of my VPN.

route 192.168.1.0 255.255.255.0 vpn_gateway

Does indeed work.

I still don't know what

The correct gateway in openvpn is the remote endpoint to the --ifconfig option, from the clients side.

means.

Could there have been something else besides vpn_gateway or net_gateway?

300000

for example if you want to tunel only www.bbc.co.uk just do this

route www.bbc.co.uk 255.255.255.0 vpn_gateway

only bbc go throught your vpn server gateway the rest go to client gateway , it is the same if you want all tranffice go through vpn server but only want youtube not so you can put like this

route www.youtube.com 255.255.255.0 net_gateway

this is the way openvpn works and if you want understand more just going to website download code to learn more.

TinCanTech

Using DNS to configure routing is considered to be a significant security risk.

The example above with youtube is guaranteed to fail and should not be considered secure.

jdratlif

Thanks TinCanTech and 300000 for your assistance.