Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Seen several questions attempting to approach this question, but none of them are very helpful. I'd like something definitive that can assist others with this question, as it comes often and rarely seems to garner a valid response.

redirect-gateway works well for me in general, but the one problem with it is that it includes local IP ranges. I understand that OpenVPN needs to do this because it needs to cover its own private IP space, which could be anything as the user arbitrarily assigns this.

It would, however, be great if one could easily gain the same effect as redirect-gateway minus one or two ranges, as appropriate for the local network they're on, so that they can still access local LAN resources (on the physical LAN, not the OpenVPN "LAN"). I'd like to exclude from the tunnel at work, for instance, but all other IP ranges would still be sent over the tunnel.

The easiest way to do this should be to leave redirect-gateway and then add a local route instructing to go over the local interface and gateway, but Windows does not seem to respect metric settings, even with automatic metrics turned off and manually tweaked metrics so that OpenVPN is always above local routes. All traffic continues to route over the VPN tunnel.

The alternative appears to be either full local route bootstrapping or teaching OpenVPN server-side to list routes like,, (my OpenVPN subnet is 172.17.17.x), And that seems like a huge pain, especially considering one must attempt to get the corresponding subnet masks correct.

Any suggestions for an easy, consistent way to configure OpenVPN that actually works (Windows route metrics don't work), preferably client-side, to exclude a few special subnets that may be local to the connecting client from the tunnel would be greatly appreciated.

For the time being I have fallen back to a SSH-provided SOCKS proxy so that I can continue to access network-local resources, but I would greatly prefer the comfort of a VPN that routes all but a few specifically mentioned address ranges.

share|improve this question
Your local LAN will always take priority over redirect-gateway def1 unless you specify otherwise with redirect-gateway def1 block-local this has nothing to do with metrics .. unless you have a routing conflict :) – dotvotdot Mar 22 at 2:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.