Pass through OpenVPN only connections to specific destinations?





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}







0















I want to connect to various streaming sites from outside US. So I using one of OpenVPN provider to do so. Default config file from provider redirects through OpenVPN all traffic.
I want to change config file to redirect through OpenVPN server only selected ip addresses. All other traffic must go through my ISP.
How can I archive this?
Can you give me real examples? For example, I need to redirect ip 1.2.3.4 through OpenVPN server.
So what route option will be?
I tried this modification of client's config:



route-gateway MY_ISP
route 1.2.3.4 255.255.255.255 vpn_gateway
redirect-gateway def1


But I failed.



Pushed options from OpenVPN provider:



PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,
dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 5,
ping-restart 40,redirect-gateway def1,redirect-gateway bypass-dhcp,
redirect-gateway autolocal,route-gateway 5.5.10.1,dhcp-option DNS 5.5.10.1,
register-dns,comp-lzo yes,ifconfig 5.5.10.91 255.255.254.0


P.S. : Client OS is Windows 7/8










share|improve this question















migrated from serverfault.com Apr 12 '13 at 16:47


This question came from our site for system and network administrators.



















  • What's the client OS?

    – MadHatter
    Apr 12 '13 at 16:17











  • Client OS is Windows 7/8

    – Tarhan
    Apr 12 '13 at 16:56


















0















I want to connect to various streaming sites from outside US. So I using one of OpenVPN provider to do so. Default config file from provider redirects through OpenVPN all traffic.
I want to change config file to redirect through OpenVPN server only selected ip addresses. All other traffic must go through my ISP.
How can I archive this?
Can you give me real examples? For example, I need to redirect ip 1.2.3.4 through OpenVPN server.
So what route option will be?
I tried this modification of client's config:



route-gateway MY_ISP
route 1.2.3.4 255.255.255.255 vpn_gateway
redirect-gateway def1


But I failed.



Pushed options from OpenVPN provider:



PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,
dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 5,
ping-restart 40,redirect-gateway def1,redirect-gateway bypass-dhcp,
redirect-gateway autolocal,route-gateway 5.5.10.1,dhcp-option DNS 5.5.10.1,
register-dns,comp-lzo yes,ifconfig 5.5.10.91 255.255.254.0


P.S. : Client OS is Windows 7/8










share|improve this question















migrated from serverfault.com Apr 12 '13 at 16:47


This question came from our site for system and network administrators.



















  • What's the client OS?

    – MadHatter
    Apr 12 '13 at 16:17











  • Client OS is Windows 7/8

    – Tarhan
    Apr 12 '13 at 16:56














0












0








0








I want to connect to various streaming sites from outside US. So I using one of OpenVPN provider to do so. Default config file from provider redirects through OpenVPN all traffic.
I want to change config file to redirect through OpenVPN server only selected ip addresses. All other traffic must go through my ISP.
How can I archive this?
Can you give me real examples? For example, I need to redirect ip 1.2.3.4 through OpenVPN server.
So what route option will be?
I tried this modification of client's config:



route-gateway MY_ISP
route 1.2.3.4 255.255.255.255 vpn_gateway
redirect-gateway def1


But I failed.



Pushed options from OpenVPN provider:



PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,
dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 5,
ping-restart 40,redirect-gateway def1,redirect-gateway bypass-dhcp,
redirect-gateway autolocal,route-gateway 5.5.10.1,dhcp-option DNS 5.5.10.1,
register-dns,comp-lzo yes,ifconfig 5.5.10.91 255.255.254.0


P.S. : Client OS is Windows 7/8










share|improve this question
















I want to connect to various streaming sites from outside US. So I using one of OpenVPN provider to do so. Default config file from provider redirects through OpenVPN all traffic.
I want to change config file to redirect through OpenVPN server only selected ip addresses. All other traffic must go through my ISP.
How can I archive this?
Can you give me real examples? For example, I need to redirect ip 1.2.3.4 through OpenVPN server.
So what route option will be?
I tried this modification of client's config:



route-gateway MY_ISP
route 1.2.3.4 255.255.255.255 vpn_gateway
redirect-gateway def1


But I failed.



Pushed options from OpenVPN provider:



PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,
dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 5,
ping-restart 40,redirect-gateway def1,redirect-gateway bypass-dhcp,
redirect-gateway autolocal,route-gateway 5.5.10.1,dhcp-option DNS 5.5.10.1,
register-dns,comp-lzo yes,ifconfig 5.5.10.91 255.255.254.0


P.S. : Client OS is Windows 7/8







redirection openvpn






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Apr 12 '13 at 16:51







Tarhan

















asked Apr 12 '13 at 15:37









TarhanTarhan

10112




10112




migrated from serverfault.com Apr 12 '13 at 16:47


This question came from our site for system and network administrators.









migrated from serverfault.com Apr 12 '13 at 16:47


This question came from our site for system and network administrators.















  • What's the client OS?

    – MadHatter
    Apr 12 '13 at 16:17











  • Client OS is Windows 7/8

    – Tarhan
    Apr 12 '13 at 16:56



















  • What's the client OS?

    – MadHatter
    Apr 12 '13 at 16:17











  • Client OS is Windows 7/8

    – Tarhan
    Apr 12 '13 at 16:56

















What's the client OS?

– MadHatter
Apr 12 '13 at 16:17





What's the client OS?

– MadHatter
Apr 12 '13 at 16:17













Client OS is Windows 7/8

– Tarhan
Apr 12 '13 at 16:56





Client OS is Windows 7/8

– Tarhan
Apr 12 '13 at 16:56










1 Answer
1






active

oldest

votes


















0














I think you'll have to insert routing entries by hand, or write a batch file doing this and stick it into the client's config:



script-security 2
up yourscript.bat


(or route-up yourscript.bat instead).



In the script, you should do something like



route add <dest_network> mask <dest_net_mask> %route_vpn_gateway%


See the manual for more info (the environment variables are explained in the "Environmental Variables" section).



You might want to also set up a matching down script which would delete the routes the up script installed — using



route delete <dest_network>





share|improve this answer
























  • OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

    – Tarhan
    Apr 12 '13 at 20:20













  • @Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

    – kostix
    Apr 12 '13 at 21:31











  • route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

    – Tarhan
    Apr 12 '13 at 23:22











  • @Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

    – kostix
    Apr 13 '13 at 11:06











  • I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

    – Tarhan
    Apr 13 '13 at 12:06














Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f582063%2fpass-through-openvpn-only-connections-to-specific-destinations%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









0














I think you'll have to insert routing entries by hand, or write a batch file doing this and stick it into the client's config:



script-security 2
up yourscript.bat


(or route-up yourscript.bat instead).



In the script, you should do something like



route add <dest_network> mask <dest_net_mask> %route_vpn_gateway%


See the manual for more info (the environment variables are explained in the "Environmental Variables" section).



You might want to also set up a matching down script which would delete the routes the up script installed — using



route delete <dest_network>





share|improve this answer
























  • OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

    – Tarhan
    Apr 12 '13 at 20:20













  • @Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

    – kostix
    Apr 12 '13 at 21:31











  • route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

    – Tarhan
    Apr 12 '13 at 23:22











  • @Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

    – kostix
    Apr 13 '13 at 11:06











  • I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

    – Tarhan
    Apr 13 '13 at 12:06


















0














I think you'll have to insert routing entries by hand, or write a batch file doing this and stick it into the client's config:



script-security 2
up yourscript.bat


(or route-up yourscript.bat instead).



In the script, you should do something like



route add <dest_network> mask <dest_net_mask> %route_vpn_gateway%


See the manual for more info (the environment variables are explained in the "Environmental Variables" section).



You might want to also set up a matching down script which would delete the routes the up script installed — using



route delete <dest_network>





share|improve this answer
























  • OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

    – Tarhan
    Apr 12 '13 at 20:20













  • @Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

    – kostix
    Apr 12 '13 at 21:31











  • route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

    – Tarhan
    Apr 12 '13 at 23:22











  • @Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

    – kostix
    Apr 13 '13 at 11:06











  • I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

    – Tarhan
    Apr 13 '13 at 12:06
















0












0








0







I think you'll have to insert routing entries by hand, or write a batch file doing this and stick it into the client's config:



script-security 2
up yourscript.bat


(or route-up yourscript.bat instead).



In the script, you should do something like



route add <dest_network> mask <dest_net_mask> %route_vpn_gateway%


See the manual for more info (the environment variables are explained in the "Environmental Variables" section).



You might want to also set up a matching down script which would delete the routes the up script installed — using



route delete <dest_network>





share|improve this answer













I think you'll have to insert routing entries by hand, or write a batch file doing this and stick it into the client's config:



script-security 2
up yourscript.bat


(or route-up yourscript.bat instead).



In the script, you should do something like



route add <dest_network> mask <dest_net_mask> %route_vpn_gateway%


See the manual for more info (the environment variables are explained in the "Environmental Variables" section).



You might want to also set up a matching down script which would delete the routes the up script installed — using



route delete <dest_network>






share|improve this answer












share|improve this answer



share|improve this answer










answered Apr 12 '13 at 17:57









kostixkostix

2,2921916




2,2921916













  • OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

    – Tarhan
    Apr 12 '13 at 20:20













  • @Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

    – kostix
    Apr 12 '13 at 21:31











  • route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

    – Tarhan
    Apr 12 '13 at 23:22











  • @Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

    – kostix
    Apr 13 '13 at 11:06











  • I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

    – Tarhan
    Apr 13 '13 at 12:06





















  • OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

    – Tarhan
    Apr 12 '13 at 20:20













  • @Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

    – kostix
    Apr 12 '13 at 21:31











  • route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

    – Tarhan
    Apr 12 '13 at 23:22











  • @Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

    – kostix
    Apr 13 '13 at 11:06











  • I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

    – Tarhan
    Apr 13 '13 at 12:06



















OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

– Tarhan
Apr 12 '13 at 20:20







OK. About bat files i understand. But what about decrease default priority of vpn_gateway? I do like you said default gateway is still VPN. But I want my ISP to be default, and VPN only for routes that i add manually like you said.

– Tarhan
Apr 12 '13 at 20:20















@Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

– kostix
Apr 12 '13 at 21:31





@Tarhan, two points: first, the route-nopull seems to enable the client to ignore any routing information passed by the server. Second, the route directive allows to set routes without resorting to up scripts.

– kostix
Apr 12 '13 at 21:31













route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

– Tarhan
Apr 12 '13 at 23:22





route-nopull indeed disable vpn server as default gateway. But now i could not create correct route to redirect connection to specific destination via VPN. I tried commands like route add 109.203.99.14 5.5.12.1 if 19 where 109.203.99.14 ip of getmyipaddress.org (for testing), 5.5.12.1 is gateway in OpenVPN adapter and interface 19 is interface of OpenVPN TAP adapter. This command adds route but nothing changes - getmyipaddress.org still displaying my ISP ip address.

– Tarhan
Apr 12 '13 at 23:22













@Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

– kostix
Apr 13 '13 at 11:06





@Tarhan, that's not how IP routing works! You should set specific routing entries for destination networks you want to be accessed using VPN. There's no sense in specifying the public IP address provided by your VPN connection as a routing entry. Also please note what I've written in my previous comment: OpenVPN seems to allow setting up routes directly -- see it's route directive.

– kostix
Apr 13 '13 at 11:06













I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

– Tarhan
Apr 13 '13 at 12:06







I think we do not understand each other. In mentioned route command example 109.203.99.14 is destination network (with mask 255.255.255.255), and 5.5.12.1 is internal VPN gateway ip address as it seen in VPN network adapter properties (public ip provided by OpenVPN provider and as seen by destination is 64.20.55.138) About latter sentence. I already know about route directive within OpenVPN. But in Windows it just calls Windows' route command like I wrote.

– Tarhan
Apr 13 '13 at 12:06




















draft saved

draft discarded




















































Thanks for contributing an answer to Super User!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f582063%2fpass-through-openvpn-only-connections-to-specific-destinations%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Сан-Квентин

8-я гвардейская общевойсковая армия

Алькесар