Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I establish an OpenVPN client connection over the Internet to our corporate OpenVPN server, it pushes several static routes. Unfortunately, these routes break some connectivity within my local network environment, as they collide with my own routes. How can I refuse those routes?

share|improve this question
up vote 13 down vote accepted

After extensive study of the openvpn manual, I have found an answer for my question:

I you don't want the routes to be executed automatically, but to be handled by your own tool, use the following option:

          Don't add or remove routes automatically.  Instead pass routes to --route-up script using environmental variables.

If you are accepting everything that is pushed by the server except the routes, use the following option:

          When used with --client or --pull, accept options pushed by server EXCEPT for routes.
          When used on the client, this option effectively bars the server from adding routes to the client's routing table, however note that
          this option still allows the server to set the TCP/IP properties of the client's TUN/TAP interface.
share|improve this answer
fyi you can also use route-nopull in the .opvn config file: stackoverflow.com/questions/35698215/… – knocte Mar 1 at 2:00

You can't refuse individual routes, however if you have access to edit your OpenVPN configuration then you can effectively stop the server --pushing any configuration to you by removing all instances of client or pull from your configuration. You will need instead to add tls-client if this directive doesn't already exist in your configuration (client is just a synonym for pull, tls-client).

Of course, if you do that, you will lose all routes and any other configuration which would normally be pushed to you, so you will need to manually configure these settings after your tunnel comes up.

share|improve this answer
hey Mike, and how to manually connfigure a route to just the subnet I'm interested in? (10.0.0._) any way to configure this in the .opvn file? – knocte Feb 29 at 12:41
route – markhorrocks Jun 8 at 13:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.