When I establish an OpenVPN client connection over the Internet to our corporate OpenVPN server, it pushes several static routes. Unfortunately, these routes break some connectivity within my local network environment, as they collide with my own routes. How can I refuse those routes?

3 Answers 3


Times have moved on, and as of 2017 (OpenVPN 2.4) this is possible with

pull-filter accept "route 192.168."
pull-filter ignore "route 172."
pull-filter accept "route 1"
pull-filter ignore "route "

This (contrived example) will allow routes to be learned that start with 192.168, ignores all 172. routes, allows other routes to 1.anything and then ignores all other routes.

To ignore redirect-gateway you can:

pull-filter ignore redirect-gateway

These commands are added to your client config file.

Likewise you can use the keyword reject which tells the VPN server it wasn't accepted. Not sure the use of this.

And finally, you can filter other config options too. I used this to ignore the DNS servers being offered, because DNS is handled by a local server for me.

  • 4
    Note, this works only in OpenVPN 2.4.x.
    – ab77
    Feb 5, 2017 at 9:46
  • Worked on OpenVPN 2.4.7 using the OpenVPN GUI 11.13.0 on Windows 10 to resolve subnet conflict between two OpenVPN Access servers both using default configs that I need up at the same time. Thank you for providing the final piece to make it work!
    – flickerfly
    Sep 18, 2019 at 20:10
  • Times move on, but OpenVPN (OpenVPN 2.5.2) still remains a buggy piece of crap: it doesn't filter out routes like 0/1, 128/1 which some sneaky VPNs dare to push to clients.
    – poige
    May 22, 2021 at 8:55
  • 4
    To ignore the DNS servers, use pull-filter ignore "dhcp-option DNS"
    – famzah
    Sep 6, 2022 at 20:23

After extensive study of the openvpn manual, I have found an answer for my question:

I you don't want the routes to be executed automatically, but to be handled by your own tool, use the following option:


Don't add or remove routes automatically. Instead pass routes to --route-up script using environmental variables.

If you are accepting everything that is pushed by the server except the routes, use the following option:


When used with --client or --pull, accept options pushed by server EXCEPT for routes.

When used on the client, this option effectively bars the server from adding routes to the client's routing table, however note that this option still allows the server to set the TCP/IP properties of the client's TUN/TAP interface.

  • 4
    fyi you can also use route-nopull in the .opvn config file: stackoverflow.com/questions/35698215/…
    – knocte
    Mar 1, 2016 at 2:00
  • @knocte FYI, all parameters to openvpn can also be specified in a config file, including standalone ones like --help.
    – kyrill
    Apr 17, 2020 at 1:45

You can't refuse individual routes, however if you have access to edit your OpenVPN configuration then you can effectively stop the server --pushing any configuration to you by removing all instances of client or pull from your configuration. You will need instead to add tls-client if this directive doesn't already exist in your configuration (client is just a synonym for pull, tls-client).

Of course, if you do that, you will lose all routes and any other configuration which would normally be pushed to you, so you will need to manually configure these settings after your tunnel comes up.

  • hey Mike, and how to manually connfigure a route to just the subnet I'm interested in? (10.0.0._) any way to configure this in the .opvn file?
    – knocte
    Feb 29, 2016 at 12:41
  • route Jun 8, 2016 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .