diff --git a/.gitignore b/.gitignore
index b37bf23..6a8d037 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,4 +24,5 @@ override.html
 override.php
 docker-compose.override.yml
 backup.json
-app/webapp/override/
\ No newline at end of file
+app/webapp/override/
+.rest
diff --git a/app/bot.php b/app/bot.php
index 4a5f6e7..ac34ef2 100644
--- a/app/bot.php
+++ b/app/bot.php
@@ -3137,6 +3137,9 @@ DNS-over-HTTPS with IP:
             $this->setPacConf($c);
             $page = floor(count($c['subnets']) / $this->limit);
         }
+        if (!empty($openconnect)) {
+            $this->ocservRoute();
+        }
         $this->subnet($wgpage, $page, $openconnect);
     }
 
@@ -3145,9 +3148,33 @@ DNS-over-HTTPS with IP:
         $c = $this->getPacConf();
         unset($c['subnets'][$k]);
         $this->setPacConf($c);
+        if (!empty($openconnect)) {
+            $this->ocservRoute();
+        }
         $this->subnet($wgpage, $page, $openconnect);
     }
 
+    public function ocservRoute()
+    {
+        $p = $this->getPacConf();
+        $c = file_get_contents('/config/ocserv.conf');
+        $t = preg_replace('~^route[^\n]+~sm', '', $c);
+        if (!empty($p['subnets'])) {
+            foreach ($p['subnets'] as $v) {
+                if (preg_match('~^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\d{1,2}~', $v)) {
+                    $t .= "route = $v";
+                    $flag = true;
+                }
+            }
+            if (empty($flag)) {
+                $t .= 'route = default';
+            }
+        } else {
+            $t .= 'route = default';
+        }
+        $this->restartOcserv($t);
+    }
+
     public function calc()
     {
         $r = $this->send(
diff --git a/config/ocserv.conf b/config/ocserv.conf
index f9f2b09..3455ab7 100644
--- a/config/ocserv.conf
+++ b/config/ocserv.conf
@@ -505,7 +505,7 @@ ipv4-netmask = 255.255.255.0
 
 # Whether to tunnel all DNS queries via the VPN. This is the default
 # when a default route is set.
-#tunnel-all-dns = true
+tunnel-all-dns = true
 
 # The advertised DNS server. Use multiple lines for
 # multiple servers.