Access to LAN through OpenVPN server

RouterOS Beginner Basics
1

I've set up my OpenVPN server to connect and access LAN behind Mikrotik. I had access to similarly configured router, so I configured it and it works but can't understand why.
The problem is with the gateway to LAN.

In Ovpn Server I set Push Routes 192.168.1.0 255.255.255.0 192.168.11.1

192.168.11.1 is supposed to be gateway address but I didn't add it to address list or configured route to or from it. Tried connecting without this address but then it doesn't work. OpenVpn client says:

2026-07-17 11:45:37 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.208 METRIC 200
2026-07-17 11:45:37 Warning: route gateway is not reachable on any active network adapters: 192.168.1.208

Where is this address configured as a gateway and why ?

Here is my configuration connected with OpenVPN:

/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5

/ip pool
add name=pool1 ranges=192.168.1.10-192.168.1.210
add name=vpn ranges=192.168.11.2-192.168.11.254

/ip dhcp-server
add address-pool=pool1 interface=bridge1 name=server1

/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,1.1.1.1,8.8.4.4 gateway=
192.168.1.1 netmask=24

/ppp profile
add bridge=bridge1 local-address=pool1 name=ovpn-profile remote-address=vpn

/interface ovpn-server server
add auth=sha256,sha512 certificate=Serwer cipher=
aes128-gcm,aes192-gcm,aes256-gcm default-profile=ovpn-profile disabled=no 
mac-address=FE:8B:DE:32:73:3F name=ovpn-server1 push-routes=
"192.168.1.0 255.255.255.0 192.168.11.1" require-client-certificate=yes 
tls-version=only-1.2

/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
2

Looking at my multi route push config (working), I note that the route push entries are just network and mask - no gateway (this in 7.22 and 7.23) so I suspect a syntactical error in your entry. I knows the gateway already, so try just this form:

push-routes="192.168.75.0 255.255.255.0, 192.168.101.0 255.255.255.0"

(The gateway, by definition, is the ovpn tunnel that pushed the route list.)

3

I tried without gateway but OpenVPN throws error

obraz

4

I didn't say no gateway . . . I said that you entered it wrong (at least compared to what I have working flawlessly on 7.22.x and 7.23.x).

"route mask COMMA route mask COMMA route mask" etc. *
(The gateway should be supplied by the server, as seen below, in a different token)

Not sure what OpenVPN client you are using, but that might be a problem, but the syntax works to my Win11, Android, and Linux clients.

Andrroid log, applied routes fine:

6:06 PM PUSH: Received control message: 'PUSH_REPLY,ping 20,ping-restart 60,topology subnet,route-gateway 172.31.11.1,route 192.168.75.0 255.255.255.0,route 192.168.101.0 255.255.255.0,ifconfig 172.31.11.2 255.255.255.0,peer-id 8'

(route-gatewayis the IP assigned to the server end of the tunnel . . . gets sent "automagically".)

You are using the OpenVPN config generated by the Mikrotik, or ???

5

RouterOS 7.23.2

There is only ONE route and ONE mask, comma is not needed
I tried suppling only route and mask but I get the error that I send in screenshot.
I seem to resolve the issue.

I set Push routes 192.168.1.0 255.255.255.0 192.168.11.1

And in ovpn-profile I set local address to 192.168.11.1.
When local address and the gateway in Push routes are different, than I can't access anything in LAN.
If they are the same, I can access all addresses.

6

I've never seen more than the two params, but looks like the doc says four. Keep in mind though, that the client can't see anything other than the OVPN server, so that ends up being the route . . .

(My case, I have 3 subnets behind the router, but don't want OVPN to default to that - public traffic flows normally, and the 3 VPN networks each get a route, but to the same gateway, which handles any subsequent hops based on it's route tables . . . I thought your case was similar.)

Oh, and I'm unclear on your statement about the "And in ovpn-profile I set local address to `192.168.11.1"

Is that on the client or the server? A push route that is to go through the OVPN tunnel needs the remote IP of the tunnel as it's route, not the local.

And the only reason I can think that other LAN traffic would fail is if you somehow got the OVPN tunnel used as the default.

Sounds like you are trying to do what I have working . . .

7

Firstly, MikroTik assigned 192.168.1.208 from your LAN pool because that pool is incorrectly configured as the PPP profile's local-address.

Your profile currently uses:

local-address=pool1

where pool1 is the LAN pool 192.168.1.10-192.168.1.210.

The local-address should normally be a fixed address on the VPN subnet, such as 192.168.11.1, while remote-address should use the VPN client pool:

local-address=192.168.11.1 remote-address=vpn

That is why the OpenVPN client tried to use 192.168.1.208 as the tunnel gateway.

the ovpn param are like this

192.168.1.0(dest) 255.255.255.0(mask) 192.168.11.1(gw) 1(metric) in the second photo i can see that 1.209 is used

Edit also didnt saw your question from the first time, thats a dinamical ip added try and post this when connected

/ip/address/print detail where address~"192.168.11.1"