Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been working with my OpenVPN server for a while, and I have a rather interesting problem. I need to redirect all client traffic through the tunnel except for a couple IP's that need to be resolvable locally. The way I'm doing this is pushing these routes from the server:

Server 'PUSH' directives

 push "redirect-gateway def1 bypass-dhcp" 
 push "dhcp-option DNS" 
 push "dhcp-option DNS"

I'm seeing that translating into these Windows routes:

Windows routes occurring

Wed Aug 31 15:14:35 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS,dhcp-option DNS,route,topology net30,ping 5,ping-restart 30,ifconfig'
Wed Aug 31 15:14:35 2011 ROUTE default_gateway=

Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD 199.[*.*.*] MASK
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD MASK
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD MASK
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD MASK

I've hidden my server's IP beginning with 199 for security purposes.

What I've gathered

I'm assuming that is a kind of code for "everything," so I'm not sure how I could get this to work, but the general idea is that I need a specific IP range (172.16.*) to be resolvable on the LOCAL NETWORK (of the client) meaning it does not go through the VPN tunnel and the client can connect to 172.16.* locally.

Is this possible? Routes can be executed through the command line, server "push" or client config options. Any way to get this to work while still routing other traffic through would do, really.

Additional Info

I have the server running on Debian 64-bit and the client running on Windows 7 (although Vista needs to work as well).

Client/server configs can be provided if needed.

share|improve this question
Technically only means "everything" when added with a netmask, or "/0". In your case, two more-specific routes ( and are added instead; the end result is the same (all addresses matched), but the added routes take priority over a "default" route. You are still correct, though. –  grawity Aug 31 '11 at 22:43

2 Answers 2

up vote 3 down vote accepted

It appears as if after doing some more research, based on grawity's answer that more specific routes will take precedence, after the server's PUSH i can simply do a

--route [ip to bypass] net_gateway

net_gateway as defined in the 'route' directive in the openvpn man page will resolve to the pre-existing ip default gateway

share|improve this answer

Simply add another route, and it will take precedence over less-specific ones:

172.16.* translates to with netmask

route add mask if index

where index is the index of your LAN network interface as shown by route print. For example, 0x3 or similar.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.