I know that from server.conf I can do this:

push "route"

but, is there a way to push routes dynamically? I have an API call that returns all routes the vpn clients will need, so in case of some route change, the client will just restart the vpn connection and it will have the new routes. Is this possible? how? I want to manage this from the server side.


The key of custom configuration is to use the client-connect option

Extract of vpn-endpoint.conf

script-security 2
client-connect /etc/openvpn/up-client

A very basic script

 ( env ; echo CONFIG_FILE  ${CONFIG_FILE} ) >> /var/log/openvpn-up-client.log
 case "$username" in
         echo 'push "route"' >>${CONFIG_FILE}
         echo 'push "route"' >>${CONFIG_FILE}

Extract of man openvpn

--client-connect cmd

Run command cmd on client connection.

cmd consists of a path to script (or executable program), optionally followed by arguments.

The path and arguments may be single- or double-quoted and/or escaped using a backslash, and should be separated by one or more spaces.

The command is passed the common name and IP address of the just-authenticated client as environmental variables (see environmental variable section below). The command is also passed the pathname of a freshly created temporary file as the last argument (after any arguments specified in cmd ), to be used by the command to pass dynamically generated config file directives back to OpenVPN.

If the script wants to generate a dynamic config file to be applied on the server when the client connects, it should write it to the file named by the last argument.

See the --client-config-dir option below for options which can be legally used in a dynamically generated config file.

Note that the return value of script is significant. If script returns a non-zero error status, it will cause the client to be disconnected.


I had the same Issue. I write a script that call a Stored procedure from Database that retourne Route. in your case API. And write these route in a file_list (sys.argv[1:]).

This script pass it as option in your serverConfig /etc/openvpn/server.conf . you write this lines :

script-security 2

client-connect /path/to/your/script

you can use python script and use append function insede your script :

file_list.append("push \"route %s %s\"\n" % (your_vpn_route, "255.255.255.x"))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.