I have been plugging away but not luck, but from what I understand what I am trying to split tunnel. I have a VPN in place (and working) where all traffic from my LAN heads out to the internet via the VPN. My challenge is that I would like to have two hosts within the LAN go to the internet directly (i.e. a TV that has Netflix, and an Xbox) and bypass the VPN in place.

I have tried making changes to my OpenVPN config but they haven't worked (currently commented out in the below files), and I suspect it stems from my routing table being an issue.

Can anyone shed light on where I'm going wrong?


Internal/LAN: enp4s0
Internet: enp5s0
VPN: tun0

OpenVPN Config

dev tun
proto udp
remote 1194
resolv-retry infinite
ping 15
ping-restart 0
reneg-sec 0
explicit-exit-notify 3
remote-cert-tls server
#push "route default"
#push "route gateway"
auth-user-pass pw.txt
verb 1
cipher AES-256-CBC
auth SHA512
script-security 2

Route Table (VPN enabled)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface       UG    0      0        0 tun0
default         _gateway         UG    0      0        0 enp5s0   U     0      0        0 tun0   _gateway UGH   0      0        0 enp5s0       UG    0      0        0 tun0
link-local     U     1000   0        0 enp5s0   U     0      0        0 enp4s0   U     0      0        0 enp5s0

Route Table (VPN disabled)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway         UG    0      0        0 enp5s0
link-local     U     1000   0        0 enp5s0   U     0      0        0 enp4s0   U     0      0        0 enp5s0

UFW Rule (to get LAN traffic to VPN)

  • Just 2 quick ideas FWIW: 1. OpenVPN has a forum that might give you access to more SMEs, and 2. OPNsense on a 3-NIC box might make your chore easier.
    – Seamus
    Aug 15, 2018 at 23:48
  • Thanks for the suggestion on OPNsense, but that would seem to mean replacing Ubuntu as my OS which I am not as keen on doing as it runs a number of services for me. That said I'll hit up the OpenVPN forum and see what they say there. Thank you!
    – Matt
    Aug 16, 2018 at 4:33

1 Answer 1


Closing this one out.

From talking to my VPN provider you can't edit the server.conf file as it sits on their side. So the resolution for a request like this is not within the OpenVPN settings, but in your route table instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .