How do I modify the OpenSSL VPN .ovpn file to support split tunnel?

Options
Zyxel_Jeff
Zyxel_Jeff Posts: 1,338  Zyxel Employee
100 Answers 500 Comments Friend Collector Fourth Anniversary
edited 5:46AM in VPN

Question:

When the USG Flex H is configured for Full Tunnel mode but Split Tunnel is also required for specific clients, you can define custom split routing by modifying the SSL VPN configuration file (.ovpn). This document outlines the steps: How do I modify the OpenVPN .ovpn file to support split tunnel?

Answer :

Please navigate to the GUI path VPN > SSL VPN > Ensure that the Internet and Local Networks (Full Tunnel) is enabled > Download the OpenSSL VPN .open file.

image.png

Open and edit the .ovpn file by removing the "redirect-gateway" directive and adding the following lines to define the split tunnel destination IP ranges:

As shown below, the user configured 192.168.168.0/24 and 192.168.169.0/24 as the destination IP ranges for the split tunnel.

Step 1: Remove the redirect-gateway directive from the .ovpn file.

image.png

Step 2: Add the following configuration to define the split tunnel destination IP ranges:

route-nopull
route 192.168.168.0 255.255.255.0
route 192.168.169.0 255.255.255.0

edit2.png

Once the .ovpn file has been edited, please upload it to the OpenVPN client and verify that the split tunnel is working correctly. The OpenVPN client should be able to access 192.168.168.1

image.png