“redirect-gateway def1 bypass-dhcp” setting kills SSH access but is needed for internet access

slopen

I am running an OpenVPN server on Ubuntu on AWS with the following server.conf:

local x.x.x.x
port 1194
proto tcp
dev tap
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.0.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.43.1.12"
push "dhcp-option DNS 10.43.1.44"
client-config-dir /etc/openvpn/ccd
client-to-client
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

I have OpenVPN clients installed on several AWS instances, some of which are Ubuntu and some of which are Windows. They all use the following client configuration:

client
dev tap
proto tcp
remote y.y.y.y 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3

I have noticed that when I remove the

push "redirect-gateway def1 bypass-dhcp"

line from the server.conf file, the Windows clients are no longer able to access the internet (they cannot ping any external sites and the browser is stuck on "Resolving host"). But I can SSH to the Ubuntu clients fine and they can still access the internet.

But when I add that line back to the server.conf file, the Windows clients are able to access the internet, but I can no longer SSH to the Ubuntu clients.

How can I change the server configuration to allow the Windows clients to access the internet AND the Ubuntu clients to accept SSH connections?

TinCanTech

Are you saying that Windows behaves differently to Ubuntu clients ?

slopen

The "push redirect-gateway def1 bypass-dhcp" line is needed for the Windows clients to access the internet. I can't tell if that line impacts the Ubuntu clients' access to the internet because that line kills SSH access to those clients.

I have to remove that line in order for SSH access to the Ubuntu clients to work. But then the Windows clients can't access the internet anymore.

TinCanTech

Do your windows clients offer SSH service ?

slopen

The Windows clients don't have SSH enabled.

TinCanTech

Have you tried enabling it yet ?

slopen

I enabled it on the Windows client, and SSH to the Windows client works regardless of whether "push redirect-gateway def1 bypass-dhcp" is in the server.conf or not.

slopen

I guess for now I will just put a file for the Windows client into the client-config-dir that contains the line "push redirect-gateway def1 bypass-dhcp". Seems like a workaround instead of a real solution that I need to send the line to Windows clients but I need to comment out the line for Ubuntu clients.

TinCanTech

What you really need to do is figure out why SSH does not work when you expect it to do so.

This really has nothing to do with openvpn.