Seen several questions attempting to approach this question, but none of them are very helpful. I'd like something definitive that can assist others with this question, as it comes often and rarely seems to garner a valid response.
redirect-gateway works well for me in general, but the one problem with it is that it includes local IP ranges. I understand that OpenVPN needs to do this because it needs to cover its own private IP space, which could be anything as the user arbitrarily assigns this.
It would, however, be great if one could easily gain the same effect as
redirect-gateway minus one or two ranges, as appropriate for the local network they're on, so that they can still access local LAN resources (on the physical LAN, not the OpenVPN "LAN"). I'd like to exclude 10.0.0.0 from the tunnel at work, for instance, but all other IP ranges would still be sent over the tunnel.
The easiest way to do this should be to leave redirect-gateway and then add a local route instructing 10.0.0.0 to go over the local interface and gateway, but Windows does not seem to respect metric settings, even with automatic metrics turned off and manually tweaked metrics so that OpenVPN is always above local routes. All traffic continues to route over the VPN tunnel.
The alternative appears to be either full local route bootstrapping or teaching OpenVPN server-side to list routes like 0.0.0.0-188.8.131.52, 184.108.40.206-220.127.116.11, 18.104.22.168-172.17.16.0 (my OpenVPN subnet is 172.17.17.x), 172.17.18.0-254.0.0.0. And that seems like a huge pain, especially considering one must attempt to get the corresponding subnet masks correct.
Any suggestions for an easy, consistent way to configure OpenVPN that actually works (Windows route metrics don't work), preferably client-side, to exclude a few special subnets that may be local to the connecting client from the tunnel would be greatly appreciated.
For the time being I have fallen back to a SSH-provided SOCKS proxy so that I can continue to access network-local resources, but I would greatly prefer the comfort of a VPN that routes all but a few specifically mentioned address ranges.