11

I installed OpenVPN on an Ubuntu machine at home, but when I connect to it, all my network traffic goes through it. I don't want this to happen.

I would like to be able to see only the local LAN network, but not routing all traffic.

How could this be done?

Thanks!

4
  • 2
    --pull-filter ignore redirect-gateway?
    – Tom Yan
    Aug 14, 2017 at 0:28
  • 2
    Also remove any redirect-gateway line in your client config.
    – Tom Yan
    Aug 14, 2017 at 0:30
  • @TomYan The Client config does not have a redirect-gateway line. What should I do with the "--pull-filter ignore redirect-gateway"? Should I put it in the client config? Aug 14, 2017 at 3:42
  • 2
    You can either put it in the config (without the --) or use it when you run openvpn (e.g. openvpn --config path/to/config --pull-filter ignore redirect-gateway)
    – Tom Yan
    Aug 14, 2017 at 8:22

3 Answers 3

13

To condense Tom Yan's comments into an answer:

  • make sure there are no redirect-gateway lines in your client config
  • add the following line to filter out any redirect-gateway settings pulled from the VPN server:
pull-filter ignore redirect-gateway

The method is documented in https://community.openvpn.net/openvpn/wiki/IgnoreRedirectGateway, but it only mentions the --pull-filter command-line parameter, not how to add it to a config file.

For completeness, there are two other methods mentioned there also:

  • Ignore all routes with route-noexec or route-nopull
  • Override them with a set of route directives. This should work even if manual routes were used rather than redirect-gateway def1 (by giving four /2 subnets that override def1's two /1 routes):
route 0.0.0.0 192.0.0.0 net_gateway
route 64.0.0.0 192.0.0.0 net_gateway
route 128.0.0.0 192.0.0.0 net_gateway
route 192.0.0.0 192.0.0.0 net_gateway
4
  • It's strange I can get this to work under Linux but not Windows... Mar 5, 2021 at 9:53
  • 1
    OK for some reason under Windows I needed to add route-nopull (Aware this is a Ubuntu exchange but it still comes up high in Google search so maybe useful for some!) Mar 5, 2021 at 10:02
  • I'm new to OpenVPN - where in the file should we add this line? It seems to work where I added it - before the <cert> area begins. Can this line be added anywhere outside of blocks like <cert> and <key>? Does order matter in OpenVPN config files?
    – rinogo
    Mar 17, 2022 at 22:39
  • @rinogo that sounds about right. I don't know of any ordering dependency in the config, and apart from things like the <cert> blocks, you can think of the directives basically as equivalent to the openvpn command-line arguments.
    – mwfearnley
    Mar 18, 2022 at 9:30
1

If you are using Ubuntu machine as OpenVpn Server you can find OpenVpn server configuration either under

/etc/openvpn/server.conf

or

/etc/openvpn/server/server.conf

if you will cat this file it will look something like this

ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_3BYLUHGJfabF8i1.crt
key server_3BYLUHGJfabF8i1.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3

You have to comment ## push "redirect-gateway def1 bypass-dhcp" and add specific traffic sub net you want to pass through this VPN server like

push  "route 10.2.2.100 255.255.255.255" ## some internet server
push  "route 54.201.1.19 255.255.255.255" ##example.com

after saving this configuration file now you can restart OPENVPN service

systemctl restart [email protected]
2
  • Thanks, this is the right approach when you want to prevent your VPN's clients to route all of their traffic through VPN. Mar 12, 2022 at 13:18
  • Thanks @ElectroBuddha Mar 24, 2022 at 14:39
0

It might help to go to VPN settings in Ubuntu Network settings. Then go to IPv4 and switch off Automatic. It seems to depend on settings in the VPN server config, but with some servers changing this setting on the client side may prevent sending all your traffic over the VPN server

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .