According to this article [url]https://openvpn.net/vpn-server-resources/how-to-setup-global-routing-in-openvpn-access-server/[/url], combining the setting of "[b]Should clients' Internet traffic be routed through the VPN[/b]" with "[b]Should VPN clients have access to private subnets[/b]" is not possible on an access server, Is there any recommended solution for a situation where this combination is required? Thanks, Assaf

Combine routing of internet traffic with accessing private network resources

assaf-2bcloud

According to this article https://openvpn.net/vpn-server-resources/how-to-setup-global-routing-in-openvpn-access-server/, combining the setting of "Should clients' Internet traffic be routed through the VPN" with "Should VPN clients have access to private subnets" is not possible on an access server,

Is there any recommended solution for a situation where this combination is required?

Thanks,
Assaf

openvpn_inc

Hello Assaf,

I have read the article 3 times from top to bottom but cannot come to the same conclusion as you have. It is possible to route client Internet traffic through the VPN server and allow access to private subnets at the same time. I do not know why you think it cannot be done. Perhaps if you could explain more clearly what the problem is?

Kind regards,
Johan

assaf-2bcloud

Actually this paragraph from the article https://openvpn.net/vpn-server-resources/microsoft-azure-byol-appliance-quick-start-guide/#running-the-openvpn-access-server-setup-wizard made me think that the two cannot coexist

> Should private subnets be accessible to clients by default?
Explanation: This option defines the default security setting of your OpenVPN Access Server. When Should client traffic be routed by default through the VPN? is set to no, it defines the list of subnets that your VPN clients are able to access. You are able to add more entries to this list once you login to the Admin Web UI area. This option will have no effect if Should client traffic be routed by default through the VPN? is set to yes.

After viewing the configuration in the admin I saw that subnets ip ranges were actually missing. Adding them made things work

I will update in case additional issues happen here or will open a new thread in case of a different problem,