1

There is one server in the local network (running Debian 7) and one remote VPN server. I have no control over the remote VPN server. I need the server in the local network to provide services (webserver etc.) to the internet directly, while I need other connections to be tunneled over the remote VPN.

I know how to setup the local server to use the remote VPN server using OpenVPN but then all connections are tunneled and the server is not listening to incoming connections from the internet anymore (only to incoming connections through the remote vpn) and can not make untunneled connections to the internet.

Is there any way to configure OpenVPN or Debian to allow two types of connection at once so that I can bind all the internet services to the internet, while binding others to the tunneled network?

2 Answers 2

0

To achieve split tunnelling, even though the remote server instructs the OpenVPN client to use the tunnel for everything, you should create a route-up script on the client that overrides the default route:

#!/bin/bash
/sbin/route delete default
/sbin/route add default $route_net_gateway

That should re-establish the default route that existed before the VPN connection was established.

0

This happens when OpenVPN is configured to tell the client to automatically route all traffic through the VPN. You will need to disable this.

Look for a redirect-gateway option in your OpenVPN server configuration and remove it. For instance it might look like one of the following:

push "redirect-gateway def1"
push "redirect-gateway local def1"

You might need to set up additional static routes for networks on the other side of the VPN connection as well.

4
  • Thanks for your answer I will have a look into the additional static routes as they might help me on the client side. Sorry that I did not mention it but I have no control over the remote VPN server.
    – Kazuo
    Aug 2, 2013 at 3:09
  • Then there's not much you can do, except to contact whoever does control the VPN server. Aug 2, 2013 at 3:09
  • So did I get this right: The server can tell the client that it should only listen to incoming connections on the VPN connection and not on the local/internet connection? And there is no way to override this on the client side?
    – Kazuo
    Aug 2, 2013 at 3:13
  • As far as I know this is controllable on the server side only. Aug 2, 2013 at 3:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .