In my previous question I was asking about setting up vpnc connection. I've installed network-manager-vpnc so now I can configure all this stuff right from network manager gui.

I have got this pretty picture from related topic:

I have got this pretty picture from related topic:

So the question is how to figure out what Address, Netmask and Gateway should I use to pass ONLY this trafic through vpn.

As a basis I have got an ip and a port of the external service which I want to use through vpnc. So inernet and other traffic should go as always through ethernet or wifi.

  • External ip:
  • Port: 1433 (this is sql server actually)
  1. Now click on the “IPv4 Settings” tab and click “Routes…”
  2. Click “Add” and in the “Address” box, enter the IP address of the machine you which to access. For our XYZ server, this is “”. In the “Netmask” box enter “” (to indicate we only want this single IP address). Leave the Gateway and Metric boxes empty.
  3. Select “Use this connection only for resources on its network”
  4. Click “Ok” on the “Editing IPv4 routes” box
  5. Click “Save…”

Copy from http://blog.rac.me.uk/2013/10/20/linux-setting-up-a-vpn-to-only-route-specific-ip-addresses/

| improve this answer | |
  • This is the best answer. Does not let all traffic go through VPN – shrimpwagon Aug 3 '17 at 13:00
  • 4
    It's a while ago, so nowadays you cannot leave the Gateway column empty. – Andy Mar 21 '18 at 23:30
  • 4
    @Andy It seems to work if you just put for gateway – multithr3at3d Jan 20 '19 at 19:13

I'm using the VPN to connect to my internal network, at the office. I want to keep my internet access using my provider, but I also want to access several machines within the office.

To do so, I select:

  • Use this connection only for resources on its network
  • Add a new route with:
    • IP address: (the address of my office network; not just one specific machine)
    • Netmask:
    • Gateway: (I get the IP from the route table after connection the VPN for the first time).
    • Metric: 1

This command line do the same as the above configuration:

sudo route add -net gw metric 1

Afterwards, I can connect to any office host on that network, using ssh, remmina, etc.

| improve this answer | |

I got "address", "netmask", and "gateway" in this way:

1) connect to VPN normally

2) run "ifconfig" command. output is somthing like this:

eth0      ....

lo        ....

ppp0      Link encap:Point-to-Point Protocol  
          inet addr:  P-t-P:  Mask:


  • set 'address' as the IP address you want to connect to it through VPN
  • set 'netmask' as 'mask' value in ppp0 output
  • set 'gateway' as 'p-t-p' value in ppp0 output
| improve this answer | |
  • Is there a way to make ti set automatically? enabling connection via "openvpn server.conf" sets all routes once "push route X.X.X.X" is added to server.conf – user578045 Aug 19 '16 at 21:37
  • for the "address" field, don't set (you IP) but (the network) – bloub Aug 3 '18 at 13:09

Set address to and netmask to

| improve this answer | |

Try running this command if you want to add a static route for only a single host

nmcli connection modify <Connection-Name> ipv4.routes ''

Or this if you want to add a static route to a subnet

nmcli connection modify <Connection-Name> ipv4.routes ''

The general syntax for the ipv4.routes setting is: 'ip[/prefix] [next-hop] [metric] [attribute=val]... [,ip[/prefix] ...]'. Documentation here: https://developer.gnome.org/NetworkManager/unstable/nm-settings.html

To find out your VPN connection name just run nmcli connection show.

A side effect of doing things like this (and not through the UI) is that you can't modify things through the UI anymore without removing this route first. It's a pretty dump validation IMHO, but you can remove the route from the UI, do whatever other changes you want and then rerun the nmcli command.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.