1

I have an OpenVPN server and local client on my destkop. I am trying to make only certain traffic to certain IPs go through the VPN. Is there a way to configure this using OpenVPN client on MacOS or Linux? Not seeing that option in the GUI config.

This information is hard to come by and very annoying to find. This explains how to blacklist ips from the VPN, but I am looking to whitelist not blacklist:

https://rmsol.de/2020/03/19/OpenVPN-bypass/#:~:text=If%20your%20are%20using%20OpenVPN,your%20bypass%2Froute%20you%20like.

Improve this question

1 Answer 1

Reset to default
2

There are at least a couple of ways of achieving this (probably more). This can either be done on the VPN client side or the server side. If you are likely to have more then connection to the server which requires it, then server side is better.

The idea in both cases is the same - You let OpenVPN know the IP addresses that need to be routed through it.

To do this on the server side, add a line for each route you want to be advertised to OpenVPN clients as going through the server with a line like

  push "route 10.11.0.0 255.255.255.0"

If you want to do this on the client side, you don't need the "push" - you can just add the following to the OpenVPN config.

  route 10.11.0.0 255.255.255.0

I guess the bit you were missing was that you don't need the "net_gateway" at the end - without this the routes will go across the VPN.

Improve this answer
11
  • thanks, what is the first IP and the second IP? aka what is 10.11.0.0 vs 255.255.255.0?
    – Alexander Mills
    Dec 19, 2020 at 8:42
  • 2
    To meaningfully understand this you really need to do a (n entry level) course in networking. 255.255.255.255 = 1 IP address, 255.255.255.0 = 256 IP addresses (also called a class C). This second number is called a subnet mask - it is used to group IP addresses together. Hopefully as a programmer this will make sense to you - Computers use bitwise operations on the IP address and netmask to quickly determine if an IP address is in the range specified by the bitmask - which is nowadays always a power of 2, ie range sizes are 1,2,4,8,16,32,64,128,256...)
    – davidgo
    Dec 19, 2020 at 21:37
  • 1
    There are a number of potential problems that are orthaganol to the question you asked. I note you have routed a single 10.x.x.x IP - while this could be correct, there is likely an issue related to NAT. With respect of really slow connection that is likely MTU related. Both of these are well outside the scope of the question you asked and require more info to resolve. If "other stuff" is going through the website its likely the server is publishing a default route that your client is incorrectly honouring. You may want to ask another question and include a network diagram and route tables.
    – davidgo
    Dec 28, 2020 at 7:20
  • 1
    Doing a trace route can give you information to show the path the packets took.
    – davidgo
    Dec 28, 2020 at 7:21
  • 1
    Never heard of dtrace. "tracert -n IP.add.re.ss" will work under Windows or you can download something better like WinMTR which will also show packet loss.
    – davidgo
    Dec 28, 2020 at 8:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .