Client-side routing

Sometimes, it is useful to allow the VPN server (or other VPN clients) to access resources connected to a particular client. This is known as client-side routing. Client-side routing in OpenVPN requires a CCD file for that client containing an iroute statement. It also requires a corresponding route statement in the OpenVPN server configuration file.

Consider the following network layout:

The subnet 192.168.4.0/24 needs to be accessible from the server-side LAN and the server-side subnet 192.168.122.0/24 needs to be accessible from the client-side LAN. This can be achieved as follows:

1. Add two lines to the basic-udp-server.conf configuration file:

   client-config-dir /etc/openvpn/movpn/clients
   route 192.168.4.0 255.255.255.0 10.200.0.1

   Save it as movpn-04-05-server.conf.

2. Create a CCD file client1 in the directory /etc/openvpn/movpn/clients with contents:

   ifconfig-push 10.200.0.99 255.255.255.0
   iroute 192.168.4.0 255.255.255.0
   push “route 192.168.122.0 255.255.255.0”

3. Ensure that...