Understanding configuration updates for split tunnel to a dynamic list of hosts about docker-openvpn

[vielmetti]

I think I can do this with a series of

[-p PUSH ...]

commands, but I didn't see an example in the docs of how this is used in any detail. However, when I invoked opvn_genconfig with

-p "route 52.52.52.52 255.255.255.255"

it looks like it did the right thing, and multiple invocations of -p add multiple lines to the server config.

[kylemanna]

If it's a split tunnel, then I assume you're avoiding routing on to the Internet, correct?

Could you use a VPN with a private subnet and send the /24 (or whatever) on to the VPN for private routing? Use ovpn_genconfig -d to make the subnet private.

Then you'll have a collection of /32s that are connected to larger subnet (i.e. /24) and routed by the openvpn daemon once the packets get there.

I use this for private networks that don't need to route to the Internet over the VPN.

[vielmetti]

Thanks for all the help. We decided to back off on the split tunnel config and just run this as a full tunnel - hope to revisit this when the VPN/VPC configuration is less complex.

This got written in the process:

http://vielmetti.github.io/post/2015/2015-12-04-split-tunnels-considered-harmful/

for what it's worth. I'll close the issue.