1. VPN
  2. OpenVPN
  3. Client Specific Overrides
  4. Edit

General Information

A description of this override for administrative reference.
Set this option to disable this client-specific override without removing it from the list.

Override Configuration

Enter the X.509 common name for the client certificate, or the username for VPNs utilizing password authentication. This match is case sensitive. Enter "DEFAULT" to override default client behavior.
Prevents the client from connecting to this server. Do not use this option to permanently disable a client due to a compromised key or password. Use a CRL (certificate revocation list) instead.
Select the servers that will utilize this override. When no servers are selected, the override will apply to all servers.
If unchecked, any client options specified in below form or Advanced section will be pushed to the client after the server options.
If checked, you can select the server options you want to remove. Any specified client option in below form or Advanced section will thus override the corresponding server-defined options.
Prevent this client from receiving any server-defined client settings.
This option will send a push-reset to the client. It will thus remove any server-defined routes, the gateway and topology.
For the client to properly connect, you will need to enter at least the gateway and topology in the below form or in Advanced section.
This will push the selected topology to the client. It should only be set when option "Remove All Server Options" is checked. It must match the actual topology specified in server.
NOTE: This will perform a "push topology [selection]" without a previous "push-remove topology". Alternetively you can push the topology in Advanced section.

Tunnel Settings

The virtual IPv4 network or network type alias with a single entry used for private communications between this client and the server expressed using CIDR (e.g. 10.0.8.5/24).
With subnet topology, enter the client IP address and the subnet mask must match the IPv4 Tunnel Network on the server.
With net30 topology, the first network address of the /30 is assumed to be the server address and the second network address will be assigned to the client.
The virtual IPv6 network or network type alias with a single entry used for private communications between this client and the server expressed using prefix (e.g. 2001:db9:1:1::100/64).
Enter the client IPv6 address and prefix. The prefix must match the IPv6 Tunnel Network prefix on the server.

Local Routes Settings

This is the IPv4 Gateway to push to the client. Normally it is left blank and configured on the server. The gateway IP should be entered if any of the options "Remove Server Local Routes" or "Remove All Server Options" is checked, as these 2 options will remove the gateway defined on the server and connection from the client will likely fail.
NOTE: Remember that, unless configured specifically, the gateway should match the IPv4 Tunnel gateway configured on the selected OpenVPN servers settings.

Remote Routes Settings

These are the IPv4 client-side networks that will be routed to this client specifically using iroute, so that a site-to-site VPN can be established. Expressed as a comma-separated list of one or more CIDR ranges. May be left blank if there are no client-side networks to be routed.
NOTE: Remember to add these subnets to the IPv4 Remote Networks list on the corresponding OpenVPN server settings.
These are the IPv6 client-side networks that will be routed to this client specifically using iroute, so that a site-to-site VPN can be established. Expressed as a comma-separated list of one or more IP/PREFIX networks. May be left blank if there are no client-side networks to be routed.
NOTE: Remember to add these subnets to the IPv6 Remote Networks list on the corresponding OpenVPN server settings.

Other Client Settings

Override server ping interval.
Ping remote over the TCP/UDP control channel if no packets have been sent for at least n seconds.
Override server ping restart/exit.
Exit or restart OpenVPN after timeout from remote.
Server 1
Server 2
Server 3
Server 4
Requires Windows 10 and OpenVPN 2.3.9 or later. Only Windows 10 is prone to DNS leakage in this way, other clients will ignore the option as they are not affected.
This is known to kick Windows into recognizing pushed DNS servers.
Server 1
Server 2
If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled.
Enter any additional options to add for this client specific override, separated by a semicolon.
The options will be pushed to the client after all above custom options.
EXAMPLE: push "route 10.0.0.0 255.255.255.0";