2
1
I've been working with my OpenVPN server for a while, and I have a rather interesting problem. I need to redirect all client traffic through the tunnel except for a couple IP's that need to be resolvable locally. The way I'm doing this is pushing these routes from the server:
Server 'PUSH' directives
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
I'm seeing that translating into these Windows routes:
Windows routes occurring
Wed Aug 31 15:14:35 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 5,ping-restart 30,ifconfig 10.8.0.6 10.8.0.5'
Wed Aug 31 15:14:35 2011 ROUTE default_gateway=192.168.1.254
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD 199.[*.*.*] MASK 255.255.255.255 192.168.1.254
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Aug 31 15:14:40 2011 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
I've hidden my server's IP beginning with 199 for security purposes.
What I've gathered
I'm assuming that 0.0.0.0 is a kind of code for "everything," so I'm not sure how I could get this to work, but the general idea is that I need a specific IP range (172.16.*
) to be resolvable on the LOCAL NETWORK (of the client) meaning it does not go through the VPN tunnel and the client can connect to 172.16.*
locally.
Is this possible? Routes can be executed through the command line, server "push" or client config options. Any way to get this to work while still routing other traffic through would do, really.
Additional Info
I have the server running on Debian 64-bit and the client running on Windows 7 (although Vista needs to work as well).
Client/server configs can be provided if needed.
Technically 0.0.0.0 only means "everything" when added with a 0.0.0.0 netmask, or "/0". In your case, two more-specific routes (0.0.0.0/1 and 128.0.0.0/1) are added instead; the end result is the same (all addresses matched), but the added routes take priority over a "default" 0.0.0.0/0 route. You are still correct, though. – user1686 – 2011-08-31T22:43:34.943