Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On a remote private network there are two servers -- a file server and a database server (these are both Win machines, in case it matters).

The file server has its own fairly robust authentication mechanisms, and allows me to connect directly from a remote location.

The database server uses a simple username and password, so to prevent unauthorized access, it's locked down to the local network -- external traffic is blocked.

To access the database server, I'm using the OpenVPN client on Windows to connect to a VPN server on the private network.

By default, OpenVPN routes all network packets destined for the remote network on which the VPN server resides, through the VPN. Unfortunately, accessing the file server through the VPN is extremely slow!

Question:

How can I configure the OpenVPN client to ONLY route traffic through the VPN that is destined for a single, specific IP address -- namely the database server??

share|improve this question
    
It's simple, see here for how to do it superuser.com/a/178675/96461 –  Sameer Alibhai Nov 26 '12 at 21:49

3 Answers 3

Goals

  • Use the plain internet connection for all internet traffic by default, even when the VPN is connected.
  • Route traffic to one specific IP address through the VPN.

Steps

  1. Press Win + R and execute ncpa.cpl.

  2. Right-click the VPN connection and go to Properties → Networking.

  3. Select Internet Protocol Version 4 and go to Properties → Advanced....

  4. Uncheck Use default gateway on remote network and click OK.

  5. (optional) Repeat the previous steps for Internet Protocol Version 6.

  6. (Re)connect to your VPN.

  7. Open a command prompt and execute route print -4.

  8. Spot the VPN's interface in the Interface list and its gateway in the Active Routes.

    On my machine, I have:

    Interface List
     32...........................Super Free VPN
    
    [...]
    
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0         On-link        10.6.6.127     31
             10.0.0.0        255.0.0.0        10.88.1.1      10.88.1.102     31
    

    Here, the VPN's gateway is 10.88.1.1, since its the gateway for the 10.xxx.xxx.xxx block.

  9. Add a persistant route that will be appended to the active routes whenever there's a connection to the VPN:

    route -p add 23.22.135.169 10.88.1.1 if 32
    

    In this example, 23.22.135.169 is the IP of whatismyip.org, 10.88.1.1 is the gateway's IP and 32 the number of the interface.

  10. (optional) Repeat the previous steps for route print -6.

  11. Test the setup.

    If everything worked out, whatismyip.org and www.whatismyip.cx will display different IPs now.

share|improve this answer
    
Surely there's a simpler way? –  Brian Lacy Aug 7 '12 at 14:56
    
I'm not sure what you mean. Step 1 to 6 are necessary to prevent routing all traffic through the VPN. (There might be some command line tool or registry hack to achieve the same purpose, but that's hardly simpler.) The rest is really just executing two commands, and you have to do all this only once. –  Dennis Aug 7 '12 at 15:14
    
Do you know how to achieve this under Linux (Ubuntu)? –  Елин Й. Mar 26 at 11:49

The correct configuration for OpenVpn is:

route-nopull 
route 192.168.0.0 255.255.255.0

These entries belong in your .ovpn file and will direct all 192.168.0.* subnet traffic through the VPN.

For one IP only (192.168.0.1):

route-nopull 
route 192.168.0.1 255.255.255.255
share|improve this answer
    
We are mostly English speakers and don't necessarily know German. Please translate your answer. –  gronostaj Aug 6 '13 at 8:44
    
+1. This is exactly what I needed. I am using ovpn clients on my linux and hence you answer just saved me. Thanks. –  slayedbylucifer May 30 at 8:33
    
Can i just route a website to vpn?For example just www.facebook.com –  Nicola Peluchetti 2 days ago

To your OpenVPN client config, add a line like:

route The.IP.To.Go 255.255.255.255

(Where The.IP.To.Go is the IP you wish to route through the VPN)

This instructs OpenVPN to create the entry in your OS's routing table.

Alternatively, the OpenVPN server could be made to "push" this routing configuration down to clients, by adding to the server config:

push "route The.IP.To.Go 255.255.255.255"

EDIT: One thing I missed addressing--the default forwarding of all traffic... It could either be disabled on the server, or clients can elect to ignore "pushed" directives (so our second option "pushing" the route would not work) with:

route no-pull

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.