I setup a OpenVPN server (VPN ip= on a Server with public ip. And I have a workstation(Ubuntu) in my laboratory with school ip that can access intranet resources of school.

I want my Android Phone and Windows PC can access the that resources. So I:

  • OpenVPN server config:

    dev tun
    topology subnet
    client-config-dir /etc/openvpn/server/ccd
    push "route"
    push "route-gateway"

  • Connect my workstation to server and get a ip, its ccd config (equivalent to client config ) is:


  • In workstation, used iptables and added some items:

    $ sudo iptables -t filter -S
    $ sudo iptables -t nat -S
    -A POSTROUTING -s -o wlx0810752b55c9 -j MASQUERADE

  • The ccd config of my pc at home is:

    push "route-gateway"
    push "redirect-gateway def1 bypass-dhcp"
    push "dhcp-option DNS"

  • Result1 The pc cannot connect to internet. The route table of that pc is:

    route print -4 35 291 291

the latter two item is what "redirect-gateway def1" added, without remove the original default gateway. I am curious that why def1 works to redirect traffic? Because the original default gateway is still there and with a better metric, thus no traffic would go through VPN.

  • Result 2 My Android Phone cannot too.

    $ busybox ip route show table all
    default via dev ccmni0 table 1002
    default dev tun0 src dev tun0 table 1015 dev tun0 src ...

I made sure that the workstation didn't receive the traffic:

$ sudo tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
0 packets captured
0 packets received by filter
0 packets dropped by kernel

I have go through much topics about this with no working solution. So, anyone can help me, any suggest is appreciated!

  • do you have client to client enabled on the openvpn server config? – Timmy Browne Apr 2 '18 at 5:57

In the ccd directory in the server the workstation file should contain iroute Try that please, I'm trying to do the same thing without using the access server and using a linux client as gateway as shown here https://www.youtube.com/watch?v=b7qr0laM8kA

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.