Don't route all traffic through VPN by client configuration

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
samb
OpenVPN User
Posts: 11
Joined: Sun Nov 29, 2015 11:38 pm

Don't route all traffic through VPN by client configuration

Post by samb » Wed Dec 19, 2018 6:01 pm

Hello,

I have a OpenVPN server setup at home on my local LAN. I use OpenVPN client on iOS and Windows to connect to my VPN side LAN and also route internet traffic through the VPN tunnel.

But sometimes I don't want the Internet traffic to route through the tunnel. So on the client I have created two OpenVPN-profiles. Default all traffic are sent to the tunnel. And the config that I want to use for only accessing the VPN side LAN I have added this:

Code: Select all

pull-filter ignore "redirect-gateway"
The config without this works as expected. I can access VPN side LAN and Internet through the home gateway.

This is my configurations!
Server Config

port 123
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.55.1"
push "dhcp-option DOMAIN example.com"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1


Client Config

client
dev tun
proto udp
remote example.com 123
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
verb 3
pull-filter ignore "redirect-gateway"
CERT AND KEYS STRIPPED...


When using the above client config I cannot access VPN side LAN or Internet via VPN. But when skipping

Code: Select all

pull-filter ignore "redirect-gateway"
I can access VPN side LAN and Internet. Local VPN side LAN DNS are used so i can access server.example.com on my home network.
Note when using the config to not route Internet traffic I also want to be able to use VPN side LAN DNS for *.example.com domains, but client side DNS for other domains on Internet.

Please help me out with advice here.
I could setup two different VPN servers with different push-directives, but that's not an ideal solution for me.

Thanks!

//Sam

samb
OpenVPN User
Posts: 11
Joined: Sun Nov 29, 2015 11:38 pm

Re: Don't route all traffic through VPN by client configuration

Post by samb » Thu Dec 20, 2018 10:18 pm

For reference I solved it by adding any of the following lines (according to what I want to filter out from my client)
client

pull-filter ignore "redirect-gateway def1 bypass-dhcp"
pull-filter ignore "dhcp-option DNS 192.168.55.1"
pull-filter ignore "dhcp-option DOMAIN example.com"
route 192.168.55.0 255.255.255.0


So I can select to use VPN as gateway for Internet, or use Local/remote DNS.

mirky
OpenVpn Newbie
Posts: 9
Joined: Mon Sep 23, 2019 2:22 am

Re: Don't route all traffic through VPN by client configuration

Post by mirky » Mon Sep 23, 2019 7:03 pm

samb wrote:
Thu Dec 20, 2018 10:18 pm
For reference I solved it by adding any of the following lines (according to what I want to filter out from my client)
client

pull-filter ignore "redirect-gateway def1 bypass-dhcp"
pull-filter ignore "dhcp-option DNS 192.168.55.1"
pull-filter ignore "dhcp-option DOMAIN example.com"
route 192.168.55.0 255.255.255.0


So I can select to use VPN as gateway for Internet, or use Local/remote DNS.
Hey there, does this still work for you?. I am trying to do the same with little luck.

So, when you don't want internet traffic routed, you simply add only "pull-filter ignore "redirect-gateway def1 bypass-dhcp"" ?.

300000
OpenVPN Power User
Posts: 54
Joined: Tue May 01, 2012 9:30 pm

Re: Don't route all traffic through VPN by client configuration

Post by 300000 » Mon Sep 23, 2019 11:25 pm

if you dont like client route all traffice over vpn link just add this one on client config and try again

route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway


you should remove pull-filter ignore "redirect-gateway" and you can use your dns and connect to your lan as nomal but everything else will go client local traffice


I used this one to vpn to connet only my dns server at home to block ad and google ad and it workes as good and all ad have been blocked by my dns at home.

mirky
OpenVpn Newbie
Posts: 9
Joined: Mon Sep 23, 2019 2:22 am

Re: Don't route all traffic through VPN by client configuration

Post by mirky » Tue Sep 24, 2019 3:36 pm

300000 wrote:
Mon Sep 23, 2019 11:25 pm
if you dont like client route all traffice over vpn link just add this one on client config and try again

route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway


you should remove pull-filter ignore "redirect-gateway" and you can use your dns and connect to your lan as nomal but everything else will go client local traffice


I used this one to vpn to connet only my dns server at home to block ad and google ad and it workes as good and all ad have been blocked by my dns at home.
Thank you.
But tried this, and not working.. however, I think the windows 10 openvpn client i am using doesn't even see these(and all other tried) changes to the config.
I don't see the routes changed either.

You know, when changes has been made, it makes the prompt to verify the config. This promt only happens so far if i comment something out #.
In the verify prompt "# This is comment" would show up, but not "route 0.0.0.0 192.0.0.0 10.1.10.1" or other like "route-nopull".
So what on earth is happening i wonder now, what can make it not see this.
I should/will try to modify on linux client.

mirky
OpenVpn Newbie
Posts: 9
Joined: Mon Sep 23, 2019 2:22 am

Re: Don't route all traffic through VPN by client configuration

Post by mirky » Tue Sep 24, 2019 4:15 pm

300000 wrote:
Mon Sep 23, 2019 11:25 pm
if you dont like client route all traffice over vpn link just add this one on client config and try again

route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway


you should remove pull-filter ignore "redirect-gateway" and you can use your dns and connect to your lan as nomal but everything else will go client local traffice


I used this one to vpn to connet only my dns server at home to block ad and google ad and it workes as good and all ad have been blocked by my dns at home.
OK. So in linux this worked for me, Windows client, nope. Thanks :). Will try and home in on windows issues.

300000
OpenVPN Power User
Posts: 54
Joined: Tue May 01, 2012 9:30 pm

Re: Don't route all traffic through VPN by client configuration

Post by 300000 » Tue Sep 24, 2019 9:32 pm

you need to run it under administrator right so it can add or remove routing table.

mirky
OpenVpn Newbie
Posts: 9
Joined: Mon Sep 23, 2019 2:22 am

Re: Don't route all traffic through VPN by client configuration

Post by mirky » Tue Sep 24, 2019 9:50 pm

300000 wrote:
Tue Sep 24, 2019 9:32 pm
you need to run it under administrator right so it can add or remove routing table.
Thanks :).
Yes, that, and I think I was using the wrong client program. Maybe didn't realize the different versions.. I had the one that installs as "Openvpn connect".. now using the "openvpn gui".
Tho, to me, i thought that in the end they should function the same, but to me they don't. It was the version I could download thru the openvpn access server user portal, which i trying out, but needed the other.

I guess maybe ... maybe.. its a feature of "openvpn connect" that users cant tamper with their config, that there are some check.

So got it solved. it works with what you wrote!.

Post Reply