You can also add pull-filter ignore redirect-gateway to the client configuration. This is helpful so you can use a config without that line in a Starbucks, so all your browsing is encrypted over the tunnel, and use a config with that line where you are in a secure location and don’t want the throughput loss of going through the tunnel.