How to refuse routes that are PUSHed by OpenVPN server?

Times have moved on, and as of 2017 (OpenVPN 2.4) this is possible with

pull-filter accept "route 192.168."
pull-filter ignore "route 172."
pull-filter accept "route 1"
pull-filter ignore "route "

This (contrived example) will allow routes to be learned that start with 192.168, ignores all 172. routes, allows other routes to 1.anything and then ignores all other routes.

To ignore redirect-gateway you can:

pull-filter ignore redirect-gateway

These commands are added to your client config file.

Likewise you can use the keyword reject which tells the VPN server it wasn't accepted. Not sure the use of this.

And finally, you can filter other config options too. I used this to ignore the DNS servers being offered, because DNS is handled by a local server for me.


After extensive study of the openvpn manual, I have found an answer for my question:

I you don't want the routes to be executed automatically, but to be handled by your own tool, use the following option:

   --route-noexec
          Don't add or remove routes automatically.  Instead pass routes to --route-up script using environmental variables.

If you are accepting everything that is pushed by the server except the routes, use the following option:

  --route-nopull
          When used with --client or --pull, accept options pushed by server EXCEPT for routes.
          When used on the client, this option effectively bars the server from adding routes to the client's routing table, however note that
          this option still allows the server to set the TCP/IP properties of the client's TUN/TAP interface.