Hi when I am not connected to my VPN and do a route print I get one entry in the Network Destination column. It has a gateway of 192.....

When I connect to my VPN and do a route print I get two entries in the Network Destination column. The first has a gateway of 192...., the same as above. The second has a gateway of 10.... which I'm assuming is my VPN gateway.

When I run a tracert to a website the I see the 10.... ip address followed by addresses in the VPN server I'm connecting to. All tests I have run online show only my VPN information. I cannot see my ip in any of the above steps.

What concerns me is that I see and 192.... on both route print's whether I'm connected to VPN or not.

Is this normal behaviour or is my VPN leaking traffic?

I have seen people say to delete the route but that would force me to be connected to my VPN all the time which I don't want.

Any help??


1 Answer 1


This is normal. See the last column Metric. If there are two routes to the same destination, the one with lower Metric value has less cost and is chosen as the better alternative. On the other hand, the VPN tunnel itself needs a route to, too.

Some (Open)VPN implementations do extra measurements to be chosen over any other connections. They split the e.g. into two halves in addition to using low metric values. As this route is more specific, it gets chosen over

Network Destination        Netmask          Gateway       Interface  Metric
      3      3

Likewise, you still see more specific routes e.g. for your physical networks:         On-link    291

That's because OpenVPN's redirect-gateway doesn't actively remove routes to local networks, whereas some other full tunneling implementations go further by doing it. From the Reference manual for OpenVPN 2.4:

–redirect-gateway flags…

Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN. This is a client-side option.This option performs three steps:

  1. Create a static route for the –remote address which forwards to the pre-existing default gateway. This is done so that (3) will not create a routing loop.

  2. Delete the default gateway route.

  3. Set the new default gateway to be the VPN endpoint address (derived either from –route-gateway or the second parameter to –ifconfig when –dev tun is specified).

There you could leak information through various protocols e.g. mDNS, LLMNR, NetBIOS or SSDP, but that's another story and doesn't affect the connections to the Internet through the VPN.

  • Is this an example of split tunnelling as opposed to full tunnel type VPN where all traffic must go through the VPN concentrator?
    – HackneyB
    Feb 23, 2019 at 22:01
  • 1
    I've added some details regarding that. Technically speaking, OpenVPN in full tunneling mode is still a split tunnel, because it allows connections to local networks. From this perspective, split tunnel is one that doesn't add routes at all, but only specific routes e.g. to a corporate network. Feb 24, 2019 at 3:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .