Without disabling split tunnel, is it possible to use another DHCP option that Tunnelblick will honor to append the VPNs resolvers (which don't forward requests for other zones). Ideal state is that if the nameservers prior to connecting to the VPN are. Use a VPN app that implements split tunneling. Several (not many) VPN services implement VPN. Yes, you can run 'Full Tunnel' which forces all internet-bound traffic to go through the VPN and out the Untangle on the remote end (and is subject to all Untangle filtering). If running as a 'Split Tunnel' where Full Tunnell is not checked only traffic to exported networks only will go through the VPN.

Have you ever noticed your Internet connection is slower when connected to a VPN? Then enabling Split Tunnel may be the answer for you!.

Split tunneling

In a VPN connection, split tunneling is the practice of routing only some traffic over the VPN, while letting other traffic directly access the Internet. Usually, what is routed over the VPN will be traffic destined for internal resources, while web surfing, email, skype, etc. will go directly to the Internet. An advantage of using split tunneling, is that it alleviates bottlenecks and conserves bandwidth as Internet traffic, does not have to pass through the VPN server.

Split tunneling can be used for several different purposes including:

• Allowing normal use of the internet while simultaneously accessing resources only available to VPN users, such as a business server
• Setting up specific devices, such as game consoles or streaming media boxes, to use (or not use) the VPN without affecting other devices on the network
• Sending all of a device’s traffic through the VPN except when accessing content or services that don’t allow VPN connections, such as MLB.tv or Netflix
• Sending all traffic through the VPN except for content and services that require low latency, such as VoIP applications and online games
• Only routing torrent traffic through the VPN, while all other internet traffic goes to the default network
• Access the VPN without affecting your connection to other devices on the local network, such as printers or a Plex Media Server

Pros

If you are going to split tunnel, then you are going to reduce the overall bandwidth impact on your Internet circuit. Only the traffic that needs to come over the VPN will, so anything a user is doing that is not “work related” will not consume bandwidth. In addition, anything external to your network, that is also latency sensitive will not suffer from the additional latency introduced by tunneling everything over the VPN to the corporate network, then back out to the Internet, and the return traffic routing over the reverse. Users will get the best experience in terms of network performance, and the company will consume the least bandwidth.

Cons

If security is supposed to monitor all network traffic, or perhaps merely protect users from malware and other Internet threats by filtering traffic, users who are split tunneling will not get this protection and security will be unable to monitor traffic for threats or inappropriate activity. Users on open networks such as hotel wireless or hotspots will also be transmitting much of their traffic in the clear. Traffic to websites that use HTTPS will still be protected, but other traffic will be vulnerable to snooping.

How to Enable Spit Tunnel in Windows 10

In order to enable Split Tunnel in Windows 10, you must be sure the VPN is already working. If you have a problem with your VPN connection, like it is not connecting, or dropping every 5 minutes, etc. Split Tunnel won’t make a difference, so resolve those issues first. Once you have a working VPN connection, the way to change VPN Split Tunnel in Windows 10 is using Powershell.

Windows is fairly limited when it comes to split tunneling. There’s no way that we’re aware of to split tunnel by app or destination. Instead, the split tunneling option in Windows is much broader. You can choose not to tunnel IPv4 and IPv6 traffic so that only local traffic goes through the VPN. That’s useful if only need to use the VPN to access remote resources not available from your normal internet connection, but not much else.

Furthermore, Windows only split tunnels VPN protocols that it has built-in support for. That means you’ll need to configure an L2TP, SSTP, or PPTP connection first. OpenVPN won’t work here.

This example, will use your local connection to access the internet while the VPN will be used to access remote resources, such as a private business server that can only be accessed via VPN. The VPN will only be used when a host isn’t available on the local network.

In this tutorial, will use Windows 10. We’ll assume you’ve already set up your VPN connection, and you only need to enable split tunneling. You’ll need admin privileges and the destination subnet for your VPN private space.

Using Powershell to configure Split Tunnel

In your Windows search bar, type Powershell and right click it to Run as administrator split tunnel windows

Type the following command and press Enter:

This will bring up a list of all your available VPN connections. (I test a lot of VPNs so there are several in my screenshot, but you’ll likely only have one.) Make a note of the Name of the VPN you want to split tunnel.

Type the following command and hit Enter, replacing <VPN NAME> with the name you noted in the previous step:

You can check that split tunneling is enabled by entering the Get-VPNConnection command again. The split tunneling field should now be set to True.

Next, enter this command and make a note of the Description field:

If necessary, add the route. Replace <DESTINATION SUBNET> with the subnet you want to route through the VPN, and <INTERFACE> with the name of the Description field we mentioned in the last step:

If you want to disable split tunneling, enter this command:

We hope this guide helps you with your VPN deployment. Here at Austral Tech we are VPN experts and we have experience setting up VPN tunnels with F5 Products, Checkpoint, Ubiquiti and Cloud providers (AWS, Azure and Google). So if you need help with your VPN deployment, don’t hesitate to contact us!

• 2Settings
  • 2.1Status
  • 2.2Server
  • 2.3Client
  • 2.4Advanced
    • 2.4.2Server Configuration and Client Configuration
• 3Reports
• 5OpenVPN FAQs
  • 5.1What operating systems are supported?
  • 5.2Can I use it with my phone or tablet?

About OpenVPN

OpenVPN enables you to create an SSL-based VPN (virtual private network) that supports both site-to-site and client-to-site tunnels. This allows your road warrior users to connect to local resources as if they were in the office, or connect the networks of several geographically distant offices together - all with the added security of encryption protecting your data. OpenVPN supports any operating system with an OpenVPN-compatible VPN client (which is almost every OS), even smartphones!

The OpenVPN application can run as a server allowing for remote client to connect to the Untangle server, and the OpenVPN application can connect to other remote Untangle servers as a client.

The VPN Overview article provides some general guidance of which VPN technology may be the best fit for different scenarios.

Settings

This section reviews the different settings and configuration options available for OpenVPN.

Status

The Status tab shows you a list of open connections, the time the tunnels were created and transmit statistics.

Connected Remote Clients

This grid shows the currently connected remote clients that are connected to this OpenVPN (if server is enabled.)

Remote Server Status

This grid shows the remote servers this OpenVPN is connecting to as a client.

Server

The Server tab includes all the configuration for OpenVPN's server functionality.

Site Name is the name of the this OpenVPN site. A random name is chosen so that it is unique. A new name can be given, but it should be unique across all Untangle sites in the organization. For example, if the company name is 'MyCompany' then 'mycompany' is a bad site name if you have multiple Untangles deployed as it might be used elsewhere. The Site Namemust be unique.

Site URL shows the URL that remote clients will use to connect to this server. This is just for reference. Verify that this address will resolve and be publicly reachable from remote networks. This URL can be configured in Config > Network > Hostname.

If Server Enabled is checked, the OpenVPN server will run and accept connections from configured Remote Clients. If unchecked the OpenVPN server will not run and not server services will be provided.

Address Space defines an IP network/space for the VPN to use internally. The Address Spacemust be unique and separate from all existing networks and other address spaces on other OpenVPNs. A default will be chosen that does not conflict with the existing configuration.

NAT OpenVPN Traffic will NAT all traffic from remote networks to local networks to a local address. This helps solve routing and host-based firewall issues. The default and recommended value is enabled.

Username/Password Authentication can be enabled to activate two factor authentication, requiring clients to also provide a username and password when connecting.

Authentication Method is used to select the authentication method for clients when Username/Password authentication is enabled.

Remote Clients

The Remote Clients sub-tab configures all the Remote Clients that can connect to this OpenVPN server. A Remote Client is any entity that connects to this OpenVPN server as a client. This includes both remote desktops, laptops, devices, road warriors, etc. This also includes remote OpenVPNs and remote Untangle networks.

Initially there are no clients that are allowed to connect and an unique entry must be created for each remote client you wish to allow to connect to this server.

To add a new Remote Client click on the Add and provide the following information:

• Enabled - If checked, this client is enabled. If unchecked, this client is disabled and can not connect.
• Client Name - A unique name for the client. (alphanumerics only)
• Group - The group for this client. More information below.
• Type - The type of this client. Individual Client for a single host like a remote desktop or laptop. Network for an entire remote network that the server should also be able to reach.
• Remote Networks - The remote network in CIDR notation if this remote client is of type Network. For example: 192.168.1.0/24 means that the 192.168.1.* network lives behind the remote client and should be reachable from the server. If there are multiple networks reachable through this remote client, a comma separated list of CIDR networks can be used. These networks are automatically exported such that hosts on the main network and other remote clients can reach these networks.

After configuring this information save the new Remote Client by clicking OK then Apply. After saving settings, click on the Download Client button in the Remote Clients table on the row for the new client.This will provide links to download the configuration profile for the configured client.

• Click here to download this client's configuration zip file for other OSs (Apple/Linux/etc). provides a zip file with the OpenVPN client configuration files. This file can be used to configure various OpenVPN clients for various OSs, like linux, apple, and even some phones/tables/devices.
• Click here to download this client's configuration file for remote Untangle OpenVPN clients. provides a zip file with the OpenVPN client configuration for setting up a remote OpenVPN application on Untangle to connect as a client to this server. For more information about how to install this on the remote client read the OpenVPN#Client documentation below.
• Click here to download this client's configuration onc file for Chromebook. provides a onc file that can be used to configure your Chromebook as a client to connect to the Untangle OpenVPN server. On the target device, browse to chrome://net-internals and use Import ONC file.

On the client system, you must first install the OpenVPN client. You can download the Windows client from here: https://openvpn.net/client-connect-vpn-for-windows/. Various downloadable OpenVPN clients such as Tunnelblick for macOS are available for other Operating Systems. After installing the OpenVPN client on the remote client, you can import the OpenVPN profile into the client.

Note: A client can only be connected once. If you install the same client on multiple remote devices they will kick each other off when a new one logs in. In most cases you need to setup a client for each remote device.

Groups

Groups are convenience feature to 'group' clients together and apply some settings to that entire group.By default there will be a Default Group. Each group has the following settings:

• Full Tunnel - If checked, remote clients will send ALL traffic bound to the internet through the VPN. This allows for Untangle to filter ALL internet traffic for connected clients by 'proxying' it through the VPN and then out through Untangle's internet connection. This will have no effect on remote Untangle OpenVPN clients. If unchecked, then only traffic destined to the local network are subject to filtering.
• Push DNS - If enable, OpenVPN will 'push' some DNS configuration to the remote clients when they connect. This is useful if you wish for some local names and services to properly resolve via DNS that would not publicly resolve.
• Push DNS Server - If set to OpenVPN Server then the IP of the Untangle server itself will be pushed to the remote clients and all remote clients will use Untangle for all DNS lookups. If Custom is selected then one or two DNS entries can be specified that will be used for DNS resolution.
• Push DNS Custom 1 - If Push DNS Server is set to custom, this IP will be pushed to remote clients to use for DNS resolution. It is important to export this address if that traffic should travel through the VPN tunnel. If this value is blank nothing will be pushed.
• Push DNS Custom 2 - Just like Push DNS Custom 1 except this sets the secondary DNS value. If blank, no secondary DNS will be pushed.
• Push DNS Domain - If set this domain will be pushed to remote clients to extend their domain search path during DNS resolution.

These settings will apply to all clients belonging to that group. Many sites will only have one group because all clients need the same settings. However, some clients have some Full Tunnel remote clients and some Split Tunnel remote clients. In this case, you need two groups where each client belongs to the appropriate group.

Exported Networks

Exported Networks is a list of networks that are reachable through the OpenVPN server for remote clients. Exported Networks are routes that are pushed to remote clients when they connect effectively telling remote clients to reach the specified network through the OpenVPN server.

For example, exporting 1.2.3.4/24 will result in all 1.2.3.* traffic going through the OpenVPN server.

The Exported Networks grid is pre-populated on installation with the IP/netmask of each static non-WAN interface.

• If Enabled is checked this network will be exported/pushed to connecting remote clients.
• Export Name is a name, purely used for documentation purposes.
• Network is the network, in CIDR notation.

Client

The Client tab is used to configure which remote servers this OpenVPN will connect to as a client.

Remote Servers

The Remote Servers grid lists the currently configured remote servers that OpenVPN is configured to connect to.

To configure a new server to connect to, first login to the remote server and configure a new client as described above and click on the Download Client as described above in the OpenVPN#Remote_Clients section. After you have downloaded the distribution zip file return to this OpenVPN and click on the Browse button below the Remote Servers grid. Select the zip file downloaded from the OpenVPN server and then press OK. Next press the Submit button to upload the zip file to OpenVPN which will add a new entry into the Remote Servers grid based on the configuration in the submitted zip file.

If the remote server requires Username/Password authentication, you will have to edit the configuration, enabled the Username/Password authentication checkbox, and enter the username and password to be used when establishing the connection.

Once connected to a remote server, you will be able to reach their exported networks. They will also be able to reach the networks on this server specified as the Remote Network in the OpenVPN#Remote_Clients configuration.

• Note: Site to Site connections are not full-tunnel even if selected in the Group for the site to site. Internet traffic on the remote site will exit through its local gateway.

Advanced

The Advanced tab is provided for advanced users who have a detailed knowledge and understanding of OpenVPN, and need very specific configuration changes to address unique or unusual situations. It is entirely possible to completely break your OpenVPN configuration with a single wrong character, misplaced space, or by changing a configuration option that probably shouldn't be changed. Changes you make on this page can possibly compromise the security and proper operation of your sever, and are not officially supported.

Common Settings

At the top of the Advanced page are the Protocol, Port, and Cipher options. These must be the same on both the client and server for connections to work. Since they are the options most frequently modified, they can be easily configured here and will apply to both the client and server.

The Client to Client Allowed checkbox is used to enable or disable traffic passing between OpenVPN clients. When enable, all clients will have full network access to each other when connected. If disabled, traffic will not be allowed to flow between connected clients.

Server Configuration and Client Configuration

If you require changes to other low level parameters, the Server Configuration and Client Configuration grids allow you to effectively have total control of the OpenVPN configuration file that is generated. Both grids work the same way, with each configuration applied to the corresponding server or client openvpn.conf file respectively.

Both lists contain config items comprised of a Option Name and Option Value pair. By default, all items in both configuration grids are read only. The lists represent the default configuration settings used for the server and client configuration files. The default items cannot be modified or deleted, they can only be excluded. When you exclude an item, it is effectively removed from the resulting configuration file. To change one of the default items, simply add a new item with the same Option Name, and input the Option Value that you want to be used. This will effectively override the default. The same method can also be used to add configuration items that are not included in the default list.

Exclude Default Configuration Item

• This example shows how to disable the comp-lzo option in the server configuration file to turn off compression:

Modify Default Configuration Item

• This example shows how to change the default keepalive setting in the server configuration file:

Add New Configuration Item

• This example shows how to add a socks-proxy setting to the client configuration file:

Reports

The Reports tab provides a view of all reports and events for all connections handled by OpenVPN.

Mac Tunnelblick Split Tunnel

Reports

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Pre-defined report queries:

The tables queried to render these reports:

• [[Database_Schema#openvpn_stats|openvpn_stats]

Related Topics

OpenVPN FAQs

What operating systems are supported?

OpenVPN supports most operating system.

Microsoft Windows

You can download the Windows client from here: https://openvpn.net/client-connect-vpn-for-windows/. After installing the OpenVPN client, you can import the OpenVPN profile into the client.

Apple Mac

For Macs, we suggest http://code.google.com/p/tunnelblick tunnelblick.

1. Download and install an OpenVPN client for MacOSX
2. Login to the Untangle Server, download the client config file zip and extract the files from the zip file.
3. Place it in the ~/Library/Application Support/Tunnelblick/Configurations folder on the Mac.
4. Run Tunnelblick by double-clicking its icon in the Applications folder.

Linux

For all other operating systems Untangle distributes a .zip with configuration and certificate files - these can be used with any OpenVPN-compatible VPN software on any operating system.

Chrome OS

Steps to install OpenVPN on Chrome OS devices:

Can I use it with my phone or tablet?

For smartphones, you'll need to install and run a VPN client that supports OpenVPN.

Normal pulse for women.

iOS based iPhones and iPads

For iPhones, we suggest OpenVPN Connect available on iTunes https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8

1. Install OpenVPN Connect app on your iPhone or iPad.
2. Login to the Untangle Server, download the client config file by selecting 'client's configuration zip for other OSs'.
3. Unzip the config file.
4. Open iTunes and select the .ovpn, .crt, and .key files from the config zip to add to the app on your iPhone or iPad.

Android Based Phones

OpenVPN for Android 4.0+ is available for connecting to Untangle OpenVPN. Detailed instructions from our forum contributor WebFool. http://forums.untangle.com/openvpn/30472-openvpn-android-4-0-a.html

1. Download/Install Openvpn for Android on your android unit.
2. Then download the Openvpn Configuration files from the Untangle Unit.
3. Unzip them and copy them to the Phone/SDcard.
4. Now Open 'Openvpn for Android'
5. Click 'All your precious VPNs'
6. In the top right corner Click on the folder.
7. Browse to the folder where you have the OpenVPN .Conf file. Click on the file and hit Select
8. Then in the top right corner hit the little Floppy disc Icon to save the import.
9. Now you should see 'imported profile' click on it to connect to the tunnel.

With OpenVPN, can I force all network traffic through the VPN tunnel?

Yes, you can run 'Full Tunnel' which forces all internet-bound traffic to go through the VPN and out the Untangle on the remote end (and is subject to all Untangle filtering). If running as a 'Split Tunnel' where Full Tunnell is not checked only traffic to exported networks only will go through the VPN.

Can I still use OpenVPN if my Untangle does not have a public IP?

Sometimes Untangle is installed behind another router (typically as a bridge). You can still run OpenVPN, however you will need to make some additional changes so remote clients can connect to the server:

1. Port forward UDP port 1194 from your router to the Untangle server. This will allow remote clients to connect to Untangle even though it doesn't have a public IP.
2. Configure your public address in Config > Network > Hostname. This is the address in the distributed clients that remote clients and networks will attempt to connect to.

Can I use OpenVPN on both of my WAN connections?

Yes. The client chooses which WAN to connect to; the server will answer via the same WAN the client connected on. The client chooses based on your configuration of Public Address. If the Public Address fails it will then try the IPs of the WANs manually as configured in the conf file.

Is there a way to setup a password for the OpenVPN users?

Yes, if you right click on the OpenVPN icon on the client's PC there is an option for a password - please note this password is only used when launching the client.

OpenVPN connects, however I can not access anything. Why is this?

Many things could cause this issue. First verify that the hosts that you are trying to reach are exported in Exported Networks. After connecting OpenVPN, try to ping Untangle's LAN IP address (if exported), then try to bring up the UI by entering the IP in a browser. If these work your tunnel is up and operational. If you can't reach a Windows machine, verify Windows Firewall is disabled on the target machine as it will block access from non-local subnets by default. If the target machine runs another OS, verify it is either using Untangle as a gateway or the machine its using as a gateway has a static route sending the VPN Address Pool to the Untangle.

How can I restrict access to certain OpenVPN users?

By default, openvpn users can connect to any machine that the Untangle can connect to. However, routes are pushed to all the 'Exported' network automatically. Beware, nothing prevents adding remote users that have administrator access to their machines to add routes manually.

If restricting access to OpenVPN users is a concern, Firewall rules or Forward Filter Rules can be used. In the Firewall, the easiest way is to create a block rule blocking traffic when Source InterfaceOpenVPN. Above that rule create rules to allow traffic when Username is the openvpn user you want to allow to the desired locations. In this scenario openvpn traffic will be blocked into your network except for explicitly allowed traffic.

Using rules you can limit access to certain resources to only the desired remote users.

Can I create site-to-site tunnels with non-Untangle devices?

When using OpenVPN for site-to-site tunnels Untangle only supports using other Untangle boxes as endpoints. Some users have had success with DD-WRT and Tomato, but this is not supported by Untangle. If you need to connect a VPN tunnel to a non-Untangle device, we recommend using IPsec VPN.

I'm using site-to-site and my software clients can only talk to the main server. Why?

If you have both software clients on the road and site-to-site tunnels, the software clients will only be able to see your main site by default. To allow them to transit the tunnel(s) to other sites, simply add the VPN Address Pool to the Exported Hosts and Networks. After this is done, software clients will be able to reach all exported sites.

How can I allow software clients to resolve DNS over the tunnel?

To allow DNS resolution for remote clients you'll need to modify some OpenVPN settings - if Untangle is doing DNS resolution on your network, simply check Push DNS in OpenVPN Settings > Server > Groups > Group Name for any groups you want to push DNS settings to. Configure the DNS settings you would like pushed to the remote clients. You may need to use the FQDN when accessing resources across the tunnel.

How do I auto-start OpenVPN when my computer boots?

This only applies to Windows XP Pro, Vista, & Windows 7 to auto-start OpenVPN on boot:First, Navigate to C:Program FilesOpenVPNconfig. This directory will have sitename.conf, sitename.ovpn and subdirectory untangle-vpn. In this directory, identify the .ovpn file that corresponds to your site's name.

Modify OpenVPN

1. Go to START > Control Panel > Administrative Tools > Services
2. Right click on OpenVPN and select Properties
3. Change Startup Type to Automatic
4. Click OK
5. Close the Services window
6. Close the Administrative Tools window
7. Close Control Panel

Modify Registry

1. Go to Start > Run > Regedit
2. Follow path down to: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
3. Locate the entry for 'openvpn-gui'
4. The command reference should say: C:Program FilesOpenVPNbinopenvpn-gui.exe
5. MODIFY IT TO: C:Program FilesOpenVPNbinopenvpn-gui.exe --connect sitename.ovpn. Where sitename is customized for your specific site.
6. Modify the following registry value to 1: HKEY_LOCAL_MACHINESOFTWAREOpenVPN-GUIallow_service
7. Exit RegEdit

When the machine restarts, the user will automatically be connected with the VPN client.

Clients are getting disconnected after 60 seconds. Why?

Macos catalina worth it. Did you share the same client config between multiple machines. If both are running they will conflict. When the second one connects the first is disconnected. After 60 seconds the first will reconnect and disconnect the second. This repeats endlessly. Do not share the same client config with multiple machines.

Tunnelblick Split Tunnel System

I'm setting up a new client and can't connect. Why?

Make sure that the IP that the client is connecting to is the public IP of the server, or that the traffic to that IP on port 1194 is being forwarded to your server. Also make sure you are testing from the outside. By default the Access Rules block OpenVPN clients from connecting to a server from one of its own LANs. This is to prevent clients from losing connectivity while on the local network because of a routing loop.

How do load a 9.4.x (server) remote network client zip on a 10.x Untangle (client)

9.4.2 site-to-site client zip will load on 10.x without modifications. 10.x has built-in converters to load 9.4 configuration zip files.

How do load a 10.0 and later (server) remote network client zip on a 9.4.x Untangle (client)

The directory structure of the client config zip has changed in 10.0. This means 9.4 Untangle instances will not load 10.0 and later config zip files correctly. The workaround is to modify the 10.0+ zip file to the 9.4 directory structure.

Modify OpenVPN config zip file for use on 9.4 instances

Tunnelblick Split Tunnel Diagram

1. Download client config zip from 10.0 OpenVPN server.
2. Unzip the config zip.
3. The directory structure is
   • openvpn-<name of untangle>-config
     • untangle-vpn
       • untangle-<random number>.conf
       • untangle-<random number>.ovpn
       • key <--- rename this directory to untangle-vpn
         • untangle-<random number>-<name of untangle>.crt
         • untangle-<random number>-<name of untangle>.key
         • untangle-<random number>-<name of untangle>-ca.crt
4. Modify untangle-<random number>.conf and untangle-<random number>.ovpn files
   • Change the following lines:
     • cert key/untangle-4855-FortWayne.crt
     • key key/untangle-4855-FortWayne.key
     • ca key/untangle-4855-FortWayne-ca.crt
   • To:
     • cert untangle-vpn/untangle-4855-FortWayne.crt
     • key untangle-vpn/untangle-4855-FortWayne.key
     • ca untangle-vpn/untangle-4855-FortWayne-ca.crt
5. Rezip the directory structure from the top untangle-vpn folder
6. Import this new remote openVPN client config file to the 9.4 Untangle in VPN client mode.

Tunnelblick Split Tunnel Diagram