When using Tunnelblick, or Viscosity in Mac OS X (both use OpenVPN underneath), my local traffic was not routed via the VPN.

This happened despite enabling the options “route all traffic through VPN”, or adding push "redirect-gateway def1" to my VPN server options as suggested by https://askubuntu.com/questions/462533/route-all-traffic-through-openvpn

After some research, I found out what is happening, and I’ve come up with a temporary fix. I believe the root cause is a bug either on Mac OS X, or on OpenVPN, but this solution circumvents it.

First, disconnected from your VPN, your routing table should look like this:

netstat -nr

Routing tables

Destination        Gateway            Flags        Netif Expire
default          UGSc           en0
127                UCS            lo0          UH             lo0

After connecting to the VPN, running netstat -nr yields:

netstat -nr

Routing tables

Destination Gateway Flags Netif Expire
0/1 UGSc utun10
default UGSc en0
10.0.8/24 UGSc utun10 UH utun10

The problem is that the default route goes through, and not
This latter being our VPN gateway.

One solution to this is to explicitly add a route via the VPN gateway to individual local clients.
For instance, to access, a local client in the remote network, we run:

sudo route add

You can add as many clients as needed, and also add groups of them with IP/Masks. After this, you should be able to access local clients in the remote network.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.