diff --git a/src/nm-system.c b/src/nm-system.c
index 6a35997f09..3bb63af16b 100644
--- a/src/nm-system.c
+++ b/src/nm-system.c
@@ -349,14 +349,15 @@ add_ip4_addresses (NMIP4Config *config, int ifindex)
 }
 
 struct rtnl_route *
-nm_system_add_ip4_vpn_gateway_route (NMDevice *parent_device, NMIP4Config *vpn_config)
+nm_system_add_ip4_vpn_gateway_route (NMDevice *parent_device, guint32 vpn_gw)
 {
 	NMIP4Config *parent_config;
-	guint32 parent_gw = 0, parent_prefix = 0, vpn_gw = 0, i;
+	guint32 parent_gw = 0, parent_prefix = 0, i;
 	NMIP4Address *tmp;
 	struct rtnl_route *route = NULL;
 
 	g_return_val_if_fail (NM_IS_DEVICE (parent_device), NULL);
+	g_return_val_if_fail (vpn_gw != 0, NULL);
 
 	/* Set up a route to the VPN gateway's public IP address through the default
 	 * network device if the VPN gateway is on a different subnet.
@@ -374,15 +375,7 @@ nm_system_add_ip4_vpn_gateway_route (NMDevice *parent_device, NMIP4Config *vpn_c
 		}
 	}
 
-	for (i = 0; i < nm_ip4_config_get_num_addresses (vpn_config); i++) {
-		tmp = nm_ip4_config_get_address (vpn_config, i);
-		if (nm_ip4_address_get_gateway (tmp)) {
-			vpn_gw = nm_ip4_address_get_gateway (tmp);
-			break;
-		}
-	}
-
-	if (!parent_gw || !vpn_gw)
+	if (!parent_gw)
 		return NULL;
 
 	/* If the VPN gateway is in the same subnet as one of the parent device's
diff --git a/src/nm-system.h b/src/nm-system.h
index 84ae6c27ed..4d3a1e8c7b 100644
--- a/src/nm-system.h
+++ b/src/nm-system.h
@@ -53,7 +53,8 @@ gboolean		nm_system_replace_default_ip4_route_vpn (int ifindex,
                                                          int parent_ifindex,
                                                          guint32 parent_mss);
 
-struct rtnl_route *nm_system_add_ip4_vpn_gateway_route (NMDevice *parent_device, NMIP4Config *vpn_config);
+struct rtnl_route *nm_system_add_ip4_vpn_gateway_route (NMDevice *parent_device,
+                                                        guint32 vpn_gw);
 
 
 gboolean        nm_system_iface_flush_addresses         (int ifindex, int family);
diff --git a/src/vpn-manager/nm-vpn-connection.c b/src/vpn-manager/nm-vpn-connection.c
index b391f1eca3..b40ee47e8b 100644
--- a/src/vpn-manager/nm-vpn-connection.c
+++ b/src/vpn-manager/nm-vpn-connection.c
@@ -85,6 +85,7 @@ typedef struct {
 	guint ipconfig_timeout;
 	NMIP4Config *ip4_config;
 	guint32 ip4_internal_gw;
+	guint32 ip4_external_gw;
 	char *ip_iface;
 	int ip_ifindex;
 	char *banner;
@@ -230,11 +231,16 @@ device_ip4_config_changed (NMDevice *device,
 	    || !nm_device_get_ip4_config (device))
 		return;
 
-	if (priv->gw_route)
+	if (priv->gw_route) {
 		rtnl_route_put (priv->gw_route);
+		priv->gw_route = NULL;
+	}
 
 	/* Re-add the VPN gateway route */
-	priv->gw_route = nm_system_add_ip4_vpn_gateway_route (priv->parent_dev, priv->ip4_config);
+	if (priv->ip4_external_gw) {
+		priv->gw_route = nm_system_add_ip4_vpn_gateway_route (priv->parent_dev,
+		                                                      priv->ip4_external_gw);
+	}
 }
 
 NMVPNConnection *
@@ -459,7 +465,6 @@ nm_vpn_connection_ip4_config_get (DBusGProxy *proxy,
 	NMIP4Config *config;
 	GValue *val;
 	int i;
-	guint32 vpn_ext_gw = 0;
 
 	nm_log_info (LOGD_VPN, "VPN connection '%s' (IP Config Get) reply received.",
 	             nm_vpn_connection_get_name (connection));
@@ -495,9 +500,10 @@ nm_vpn_connection_ip4_config_get (DBusGProxy *proxy,
 	/* External world-visible address of the VPN server */
 	val = (GValue *) g_hash_table_lookup (config_hash, NM_VPN_PLUGIN_IP4_CONFIG_EXT_GATEWAY);
 	if (val) {
+		priv->ip4_external_gw = g_value_get_uint (val);
 		nm_ip4_address_set_gateway (addr, g_value_get_uint (val));
-		vpn_ext_gw = g_value_get_uint (val);
-	}
+	} else
+		priv->ip4_external_gw = 0;
 
 	val = (GValue *) g_hash_table_lookup (config_hash, NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS);
 	if (val)
@@ -576,8 +582,8 @@ nm_vpn_connection_ip4_config_get (DBusGProxy *proxy,
 			 * the VPN server, we want to use the NM created route instead of
 			 * whatever the server provides.
 			 */
-			if (   vpn_ext_gw
-			    && nm_ip4_route_get_dest (route) == vpn_ext_gw
+			if (   priv->ip4_external_gw
+			    && nm_ip4_route_get_dest (route) == priv->ip4_external_gw
 			    && nm_ip4_route_get_prefix (route) == 32)
 				continue;
 
@@ -604,7 +610,11 @@ nm_vpn_connection_ip4_config_get (DBusGProxy *proxy,
 		NMDnsManager *dns_mgr;
 
 		/* Add any explicit route to the VPN gateway through the parent device */
-		priv->gw_route = nm_system_add_ip4_vpn_gateway_route (priv->parent_dev, config);
+		if (priv->ip4_external_gw) {
+			priv->gw_route = nm_system_add_ip4_vpn_gateway_route (priv->parent_dev,
+			                                                      priv->ip4_external_gw);
+		} else
+			priv->gw_route = NULL;
 
 		/* Add the VPN to DNS */
 		dns_mgr = nm_dns_manager_get (NULL);