Windows – openvpn routing in windows vista without admin privileges

The Windows 7 client machine is most likely caching the IP entry in it's ARP table or routing table. This Microsoft article outlines some default ARP behavior on Windows 7 http://support.microsoft.com/kb/949589, including what the default time an entry is retained for. To test this hypothesis, I would connect using OpenVPN, disconnect, then flush the ARP table, and/or flush the routing table as well and see if the route still persists. If it's immediately gone, see how long it takes Windows 7 to remove the route without the manual flush. If that is the case, then you'll have to find a way to modify the default lifetime of a route/arp entry either via OpenVPN or a Windows 7 parameter or flush the table on the client post OpenVPN disconnect.

Your routing is fine.

The server is the destination because you are looking at the IP header.

You have to look at the Ethernet frame header to see the routing towards your gateway.

Obviously, you won't see IPs there, what you will see is that the destination of your packet is the MAC address of your gateway (192.168.3.1).

Unfortunately it's impossible to "sniff" VPN packets with Wireshark on Windows.

This doesn't mean you cannot see that packets that you are sending in the VPN tunnel, you just don't see the encapsulating part of these packets that allow them to transit within the VPN tunnel and get encrypted.

This also leads to the second part of your comment.

The reason why you don't see your data as encrypted is simply because you are not sniffing the traffic as it leaves your interface physically. You are sniffing the traffic as it leaves your internal interface and before it's sent to the virtual interface that OpenVPN created.