3

whats the best way to configure openvpn clients to go selectively go about using an openvpn connection? i want to setup a vpn server for friends in china, but i dont want them to use it for everything, just so they can access sites like youtube, facebook, cnn, etc. while they are in china through the vpn (these are blocked).

it would be nice if the vpn was a backup, so for instance if they are trying to go to facebook (which is blocked), it would go through the vpn connection once finding that the normal connection does not work.

this would save a lot of bandwidth cost actually, and give them a better browsing experience.

is this a iptable route thing? or a dns server that i push to my clients?

2
  • Can you tell us how China 'blocks'? Is it a 403, a 404, a 200 custome page, a connection reset or a connection drop?
    – chmeee
    Apr 22, 2010 at 13:10
  • @chmee: they use multiple ways, lately they send TCP RST packets. Apr 23, 2010 at 11:19

3 Answers 3

1

I would suggest setting up a transparent Squid proxy on your end accessible through the VPN and not push any routes (besides the OpenVPN subnet obviously) and have them install something like FoxyProxy in Firefox as their proxy client. FoxyProxy supports patterns, so you can have them add the sites you want to proxy through your VPN for them (*.facebook.com, etc.).

You'll also have the benefit of logging (they're your friends, but still) and caching (at least saving you some upstream bandwidth) with Squid.

3
  • =1 I think a proxy is the best solution
    – chmeee
    Apr 24, 2010 at 13:38
  • i think ill take dan's advice. yours is an easier and possibly better solution, but I don't want to force them to install more client software than they have to. i was envisioning a click and go vpn simple solution. good recommendation though +1
    – mx2323
    Apr 28, 2010 at 18:52
  • FoxyProxy -- like all FireFox add-ons -- is simple/trivial to install. Doing it the "wrong" way so that your friends don't have to click a few times? Hey, it's your call.
    – gravyface
    Apr 28, 2010 at 19:23
0

You should be able to do that directly with OpenVPN. There are three steps: 1) tell the openvpn server about the new route, 2) tell the client kernel about the new route and 3) tell the kernel of the openvpn server about the new route

  1. add "route 69.63.189.16 255.255.255.255 " in the config file
  2. can be accomplished adding a "push "route 69.63.189.16 255.255.255.255""
  3. you have to create a client configuration file in the directory specified by the client-config-dir option and add the option "iroute 69.63.189.16 255.255.255.255"

add as many routes as you like, each one in all three places.

-- EDIT --

If you want to use DNS, you can add zones so that the sites that you want redirected appear to have VPN addresses, i.e. cnn.com -> 10.10.10.10, bbk.co.uk -> 10.10.10.11 and so on. Then at the firewall/router, you need to add NAT rules to translate those internal IP addresses to the real addresses again.

3
  • this means, a route for an ip 69.63.189.16 to 255.255.255.255. but if they type in cnn.com, their dns server won't know that the ip of cnn.com should be "69.63.89.16". so is there still a missing piece with regards to resolving that domain name to the ip of the route....? i see that i can push a dns server to the client.. is that the way to do it?
    – mx2323
    Apr 22, 2010 at 23:01
  • It may work, however it will work only with Windows clients. You can create a fake authoritative server with the info you want, and reroute the DNS through it. Apr 23, 2010 at 6:33
  • yea, this is the solution i will likely take.. thanks dan!
    – mx2323
    Apr 28, 2010 at 18:53
0
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

must reconfigure dnsmasq and resolvconf - this may only work on windows clients.

However

push "redirect-gateway bypass-dhcp" 

might work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .