iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
To send a Linux VPS’s outbound IPv4 traffic through an OpenVPN tunnel, add redirect-gateway def1 to the OpenVPN client configuration. The option installs two broad routes, 0.0.0.0/1 and 128.0.0.0/1, so traffic uses the VPN while the original default route remains available. Before reconnecting, add a host route for the public IP address of your SSH client through the VPS’s original gateway. Without that exception, SSH replies follow the new VPN route and the existing session usually stalls.
The safest rollout is: save the current routes, configure the tunnel and SSH exception, test from a second session, verify DNS and public egress, and keep console access available for rollback.
Free tools Windows power users keep installed
One-click scans. No signup required.
What changes when you use redirect-gateway def1
An OpenVPN client normally creates a tunnel interface, often named tun0, but leaves the VPS’s ordinary default route in place. Applications continue to use the VPS provider’s gateway unless you add routes that point elsewhere.
redirect-gateway def1 changes that behavior for IPv4. OpenVPN first ensures that the VPN server’s own endpoint remains reachable through the pre-existing gateway, then installs two covering routes:
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
0.0.0.0/1covers addresses from 0.0.0.0 through 127.255.255.255.128.0.0.0/1covers addresses from 128.0.0.0 through 255.255.255.255.
Those two routes are more specific than a normal 0.0.0.0/0 default route, so ordinary outbound traffic enters the tunnel. Because the original default route is not replaced outright, OpenVPN can still use it for the VPN endpoint and for carefully added exceptions. This is the reason the def1 form is commonly used instead of replacing the default route with a single new default.
Why an existing SSH session can drop
Suppose your administrator connects from 198.51.100.24. Before the tunnel starts, the VPS sends replies to that address through its provider gateway. After the redirect routes are installed, the destination matches one of the two /1 routes. The reply is sent into the VPN instead of back to the administrator, so the TCP session stops receiving packets even though the SSH process is still running.
A host route for the administrator’s address is more specific than either /1 route. The VPS therefore sends packets for 198.51.100.24 through the original gateway while sending other destinations through the tunnel.
Prerequisites and a safe test plan
- A Linux VPS with root or equivalent administrative access.
- An OpenVPN client configuration supplied by a VPN service or your own VPN server. Whether a particular provider supports OpenVPN is provider-specific.
- The OpenVPN client package and the
iproute2tools, including theipcommand. - A second SSH session or the VPS provider’s out-of-band console. Do not make a routing change on your only management connection.
- The public IPv4 address from which you are connecting. A fixed office or bastion address is easier to protect than a frequently changing residential address.
Record the current state before changing anything:
ip -4 route show
ip -4 route show default
ip -4 addr showThe default-route output normally contains a gateway and interface, for example default via 203.0.113.1 dev eth0. Record those values. Also note the VPN server’s hostname or address and the OpenVPN service name used by your distribution.
Configure the OpenVPN client
Minimal client configuration
Add the redirect directive to the client profile that the service actually loads:
client
dev tun
proto udp
remote vpn.example.net 1194
redirect-gateway def1
persist-key
persist-tunKeep the certificate, key, authentication, cipher and other provider-specific lines already present in your profile. Do not copy the example endpoint or port literally; they are only illustrative. If the server pushes its own redirect directive, a client-side exception may be needed, as described later.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Keep the VPN endpoint on the original path
OpenVPN’s redirect behavior adds a route to the remote endpoint through the existing gateway before changing the effective default path. This prevents a routing loop in which the encrypted tunnel would need to reach its own server through itself. If you use a hostname for remote, make sure it resolves before the route change and check that the resulting address is reachable through the provider gateway.
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Enable an up script
An up script runs after the TUN/TAP device opens and before an OpenVPN --user privilege drop. A common configuration pattern is:
script-security 2
up /etc/openvpn/add-ssh-route.shThe exact meaning of each script-security level can vary by OpenVPN version and should be checked against the manual installed on your VPS. Treat the value above as a pattern from commonly used guides, not as a universal guarantee.
Add the SSH exception route
Fixed administrator address: the most reliable method
If your administrative address is stable, add a host route for it using the original gateway and interface. With the example values recorded earlier:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallip -4 route replace 198.51.100.24/32 via 203.0.113.1 dev eth0Install this route at every tunnel connection, not only once at boot. A route created manually disappears when the tunnel or network namespace is rebuilt. You can place the command in the OpenVPN up script or use the distribution’s persistent networking configuration, provided it runs after the ordinary interface and gateway exist.
Dynamic address: an up-script pattern
Some guides discover the current interactive SSH client with who -m --ips, read the current default gateway, and add a host route. The following is an intentionally simple IPv4 example:
#!/bin/sh
set -eu
SSH_IP=$(who -m --ips | awk 'NR==1 {gsub(/[()]/,x,$NF); print $NF}')
GW=$(ip -4 route show default | awk 'NR==1 {print $3}')
DEV=$(ip -4 route show default | awk 'NR==1 {print $5}')
if [ -z $SSH_IP ] || [ -z $GW ] || [ -z $DEV ]; then
exit 0
fi
ip -4 route replace $SSH_IP/32 via $GW dev $DEVSave it as /etc/openvpn/add-ssh-route.sh and make it executable:
chmod 700 /etc/openvpn/add-ssh-route.shThis pattern assumes the first address reported by who -m --ips is the management client and that the address is IPv4. A service started without an interactive login may have no useful who entry, and multiple simultaneous administrators make a single automatically chosen address ambiguous. For those cases, use a fixed administrator address, generate one host route per approved address, or arrange a separate management network.
Rank #3
- 【DUAL BAND AX TRAVEL ROUTER】Products with US, UK, EU Plug; Dual band network with wireless speed 574Mbps (2.4G)+2402Mbps (5G); 2.5G Multi-gigabit WAN port and a 1G gigabit LAN port; USB 3.0 port; Wi-Fi 6 offers more than double the total Wi-Fi speed with the MT3000 VPN Router.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Beryl AX automatically encrypts all network traffic within the connected network. Max. VPN speed of 150 Mbps (OpenVPN); 300 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【OpenWrt 21.02 FIRMWARE】The Beryl AX is a portable wifi box and mini router that runs on OpenWrt 21.02 firmware. It supports more than 5,000 ready-made plug-ins for customization. Simply browse, install, and manage packages with our no-code interface within Beryl AX's Admin Panel.
- 【PROTECT YOUR NETWORK SECURITY】Our pocket wifi, unlike other vulnerable portable wifi hotspot for travel purposes supports WPA3 protocol–Preventive measures against password brute-force attacks; DNS over HTTPS & DNS over TLS–Protecting domain name system traffic and preventing data eavesdropping from malicious parties; IPv6–Built-in authentication for privacy protection, eliminating the need for network address translation.
- 【VPN CASCADING AT EASE】Surpassing the mediocre performance of most VPN routers for home usage, the Beryl AX is capable of hosting a VPN server and VPN client at the same time within the same device, enabling users to remote access local network resources like Wi-Fi printers or local web servers, and accessing the public internet as a VPN client simultaneously.
Some systems still provide the older route add -host command; others provide only ip route. Use the syntax native to your distribution and verify the result with ip -4 route get 198.51.100.24.
Apply the configuration without locking yourself out
- Open a second SSH connection from the same administrator address, or open the provider console.
- Check that the route script is executable and that the OpenVPN profile references the correct path.
- Start the client in the foreground first when possible, for example with the distribution’s OpenVPN command and the profile path. Watch for authentication, certificate, DNS and route errors.
- After the tunnel reports that it is up, inspect the routes:
ip -4 route show
ip -4 route get 1.1.1.1
ip -4 route get 198.51.100.24The lookup for an ordinary public address should select the VPN interface or its tunnel gateway. The lookup for the SSH client address should select the original physical interface and gateway.
- From the second session, run a harmless command, start a new SSH connection, and verify that the first session remains responsive.
- Only after those checks should you enable or restart the normal OpenVPN system service. Service-unit names differ by distribution; use the unit associated with your installed client profile rather than assuming a particular name.
Keep the console session open until you have tested a disconnect and reconnect. If the tunnel fails, remove redirect-gateway def1 or stop the client from the console, then restore the original route set if necessary.
Verify that traffic really uses the VPN
Route-level checks
Use the kernel’s route lookup rather than guessing from the interface list:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →ip -4 route get 1.1.1.1
ip -4 route get 203.0.113.80The output should identify the TUN interface or the VPN-provided next hop for destinations that are not covered by an exception. Check the SSH address separately to confirm the host route wins by longest-prefix matching.
Public egress check
Query a service that reports the source address, or inspect the destination application’s logs. The observed public address should be the VPN server’s egress address rather than the VPS provider’s address. This confirms IPv4 egress, but it does not prove that every application uses the same resolver, socket family or network namespace.
DNS check
Changing routes can expose resolver problems. Test both numeric connectivity and name resolution:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
ping -c 3 1.1.1.1
getent hosts example.comIf numeric traffic works but name lookups fail, inspect the resolver configuration used by the VPS, such as /etc/resolv.conf or the system resolver service. A VPN route change does not automatically make every DNS resolver reachable or change applications that use a hard-coded resolver. Correct the resolver path according to your distribution and VPN provider, then repeat the lookup test.
What happens when the VPN reconnects
The SSH host route is not a permanent property of the VPS. It can disappear when the tunnel interface is destroyed, when networking restarts, or when the client reconnects. If it disappears, the next SSH reply can again follow a /1 route into the tunnel.
Attach the route command to a hook that runs on every successful connection, such as the up hook shown above, and verify that the hook is invoked after reconnects. If your service manager starts the client before the ordinary interface has a gateway, delay the client or use the manager’s network-online dependency. Test by stopping and restarting the VPN while a separate SSH session is active.
Selective routing when all traffic should not use the VPN
A full redirect is not always appropriate. Management, monitoring, storage, license servers or provider metadata endpoints may need the VPS’s normal path, while only a particular application or destination should use the VPN.
Push only the required destination routes
The server can push routes for selected networks instead of a default redirect. This gives a smaller blast radius, but you must know every destination that should traverse the tunnel and maintain the list as the application changes.
Ignore pulled routes with route-nopull
route-nopull prevents the client from installing routes pushed by the server while still allowing the server to provide TUN/TAP properties. You can then add explicit route directives or operating-system routes for the destinations you choose. Be careful: suppressing pulled routes may also suppress routes the VPN needs for its intended topology.
Filter only the redirect directive
For OpenVPN 2.4 and later, community guidance commonly recommends pull-filter ignore redirect-gateway when the server pushes a redirect that the client should not accept. Support and exact behavior should be verified against the OpenVPN version installed on your VPS. If the client is older, use the documented options available for that release rather than assuming this directive exists.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Policy routing
Policy routing separates traffic by source address, firewall mark, user, process or destination. A typical design disables or avoids unwanted pulled routes, assigns the OpenVPN client to a dedicated interface or routing table, and sends only selected traffic to that table. It is more work than redirect-gateway def1, but it avoids broad changes to unrelated services and is usually the better long-term design for multi-service VPS hosts.
Recommended Free Tools
Useful route options
| Option or technique | Effect | When to use it |
|---|---|---|
redirect-gateway def1 |
Routes normal IPv4 traffic through two covering /1 routes while retaining the original default route. |
Most or all outbound IPv4 traffic should use the VPN. |
| Host route to the SSH client | Sends management replies through the original gateway, overriding the broad VPN routes. | Any time you must preserve an SSH session over a redirected client. |
route-nopull |
Stops the client from adding routes pushed by the server. | You want to construct the route set locally. |
pull-filter ignore redirect-gateway |
Filters a pushed redirect directive on supported versions. | The server pushes a full redirect but the client needs selective routing; verify version behavior. |
route-gateway |
Sets the gateway used with OpenVPN route directives; dhcp obtains it from DHCP negotiation. |
Manually defining routes in the client profile. |
up |
Runs a command after the TUN/TAP device opens and before an OpenVPN --user UID change. |
Installing a management exception on each connection. |
Troubleshooting common failures
SSH dies immediately after the tunnel connects
From the console, run ip -4 route get 198.51.100.24. If it selects the TUN interface, the host route is missing, has the wrong gateway, or uses the wrong interface. Add or correct the /32 route, then reconnect SSH. If the address changed, update the exception; a route for an old address does not protect a new session.
The VPN connects but the VPS has no Internet access
Check that the endpoint route exists, the two /1 routes are present, and the VPN server permits forwarding and Internet egress. Compare ip -4 route get 1.1.1.1 with a numeric connectivity test. If the lookup still uses the physical interface, the profile may not be the one being loaded or a later service may have replaced the routes.
DNS stopped working
Separate routing from resolution by testing a numeric address first. If that succeeds, inspect the resolver service and its configured nameservers. Ensure the resolver’s addresses are reachable through the intended route, and account for local caching or split-DNS software that may continue using the pre-VPN interface.
The route script reports no client address
This occurs when the OpenVPN service starts without an interactive SSH login, when who -m --ips is unavailable, or when the login is from IPv6 while the script handles only IPv4. Use an explicitly configured management address, support all required address families, or install separate routes for each approved administrator network.
The route works once but disappears later
Confirm that the command is attached to a connection hook and that the hook runs after reconnect. Inspect the routes after deliberately restarting the VPN. If a network manager or firewall service rewrites routes, adjust its ordering or move the exception into the component that owns the interface lifecycle.
You cannot recover through SSH
Use the VPS provider’s serial, web or rescue console. Stop the OpenVPN client, remove the redirect directive, and restore the original default route if it was altered. Keep a tested console path available before attempting another change.
Choosing between a full redirect and selective routing
| Decision factor | Full redirect with def1 |
Selective routes or policy routing |
|---|---|---|
| Traffic scope | Most outbound IPv4 traffic enters the VPN. | Only listed destinations, sources or applications enter the VPN. |
| Initial setup | Usually simpler, provided the SSH host route and endpoint route are correct. | More design and testing; route tables, marks or pushed routes may be required. |
| Management safety | Requires an explicit exception for every management source that must stay on the provider path. | Can leave management traffic untouched by default. |
| Reconnect behavior | The host exception must be re-added whenever the tunnel is rebuilt. | Rules still need lifecycle handling, but a narrow policy can reduce accidental impact. |
| Best fit | A single-purpose VPS whose outbound traffic should generally use one VPN. | A multi-service VPS with different routing requirements. |
Operational checklist
- Confirm the OpenVPN profile and service unit that will be changed.
- Record the original gateway, interface and administrator address.
- Ensure console or a second SSH session is available.
- Add
redirect-gateway def1only when a full IPv4 redirect is intended. - Add and test a
/32host route for every management source that must remain reachable. - Use an
uphook or equivalent lifecycle mechanism so the route returns after reconnect. - Verify route lookups for both a public destination and the SSH client.
- Test numeric connectivity, DNS resolution and the observed public egress address.
- Check the behavior after stopping and restarting the tunnel.
- Document the rollback command and retain console access.
The practical rule is simple: use redirect-gateway def1 for the broad change, protect management with a more-specific route through the original gateway, and treat DNS plus reconnect behavior as part of the configuration rather than as afterthoughts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
