Route to VPN server is always bound to the first interface

[ferrao]

I establish two VPNs with OpenVPN. Each one get's it's own interface tun0 and tun1
But the route configured with the --route argument always get's applied to the first interface (tun0).

Both VPNs have the bellow config:

client
dev tun
remote zzz.zzz.zzz.zzz 10443 tcp
tun-mtu 1400
tls-client
nobind
user nobody
group nobody
ping 15
ping-restart 45
persist-tun
persist-key
mute-replay-warnings
verb 3
cipher AES-256-CBC
auth SHA256
pull
auth-user-pass
connect-retry 1
reneg-sec 3600
remote-cert-tls server

I can see the following output from running openvpn:

VPN1

2026-07-22 13:28:59 net_route_v4_best_gw query: dst 0.0.0.0
2026-07-22 13:28:59 net_route_v4_best_gw result: via 192.168.1.1 dev wlan0
2026-07-22 13:28:59 net_route_v4_best_gw query: dst zzz.zzz.zzz.zzz
2026-07-22 13:28:59 net_route_v4_best_gw result: via 192.168.1.1 dev wlan0
2026-07-22 13:28:59 TUN/TAP device tun0 opened
2026-07-22 13:28:59 tun/tap device [tun0] opened
2026-07-22 13:28:59 net_iface_mtu_set: mtu 1400 for tun0
2026-07-22 13:28:59 net_iface_up: set tun0 up
2026-07-22 13:28:59 net_addr_v4_add: xxx.xxx.xxx.xxx/24 dev tun0
2026-07-22 13:28:59 net_route_v4_add: 192.168.100.0/24 via xxx.xxx.xxx.xxx dev [NULL] table 0 metric -1

VPN2

2026-07-22 13:29:03 net_route_v4_best_gw query: dst 0.0.0.0
2026-07-22 13:29:03 net_route_v4_best_gw result: via 192.168.1.1 dev wlan0
2026-07-22 13:29:03 net_route_v4_best_gw query: dst zzz.zzz.zzz.zzz
2026-07-22 13:29:03 net_route_v4_best_gw result: via 192.168.1.1 dev wlan0
2026-07-22 13:29:03 TUN/TAP device tun1 opened
2026-07-22 13:29:03 tun/tap device [tun1] opened
2026-07-22 13:29:03 net_iface_mtu_set: mtu 1400 for tun1
2026-07-22 13:29:03 net_iface_up: set tun1 up
2026-07-22 13:29:03 net_addr_v4_add: yyy.yyy.yyy.yyy/24 dev tun1
2026-07-22 13:29:03 net_route_v4_add: 192.168.101.0/24 via yyy.yyy.yyy.yyy dev [NULL] table 0 metric -1

But on my route table:

192.168.100.0   xxx.xxx.xxx.xxx  255.255.255.0   UG    0      0        0 tun0
192.168.101.0   yyy.yyy.yyy.yyy  255.255.255.0   UG    0      0        0 tun0

If I remove the second route and re-add it to tun1, everything works as I expected to.
I have also tried to use dev tun0 and dev tun1 on each ovpn file, but it makes no difference, I still get both routes added to tun0

• OS: Arch Linux
• OpenVPN version: 2.7.5 [git:makepkg/b25bb2a8bda814ed+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] built on Jul 1 2026
  library versions: OpenSSL 3.6.3 9 Jun 2026, LZO 2.10

[ferrao]

Forgot to tell how I invoke it:

sudo openvpn \
  --config "${CONFIG_FILE}" \
  --auth-user-pass "${AUTH_FILE}" \
  --askpass "${KEY_FILE}" \
  --route "${NETWORK}" "${NETMASK}" "${GATEWAY}" \
  --data-ciphers AES-256-CBC \
  --data-ciphers-fallback AES-256-CBC \
  --disable-dco \
  --compat-mode 2.4.0

[schwabe]

The log has not enough context to understand what is going on for you. Also we have to trust that you did not mess up the anonymising of the IP when you prepared the log. Please included also the pushed options from the server.

To me it looks like you already screwed up the anonymising of the IP addresses or have a very weird setup since you are adding router to client IP. Normally routes target the peer IP address.

[cron2]

The openvpn logs given show routes installed to "xxx" and "yyy", which are addresses configured on the respective tunnels, which would be the correct thing to do.

So either your log files are not correctly xxx'ed and yyy'ed, or there is something else going on, which we can't see. Please show unanonymized logs of the "ifconfig" and "route" statements, and also an unanonymized output of ip route in the system before any VPN starts, after VPN1 is started, and after VPN1+VPN2 are started.