0

Dear Everyone I am currently using openvpn for normal browsing. However, I have the following services running: a bit torrent client, a web server, IRC and a git server which I would really want it to not be using my vpn connection (and use my original connection instead).

Is there a way to do this? I looked up policy routing and I can't really find any tutorial on how to do this on linux (I am on ubuntu). I don't want the solution to be incredibly complicated - I am pretty new to networking in ubuntu and I only want a very simple solution to this problem.

Can someone help me out?

Improve this question
0

3 Answers 3

Reset to default
1

Unfortunately policy routing IS incredibly complicated. I have an open question asking about tools to make policy/tc easier to use, and I haven't seen any great answers yet. I have started working on something on my own, but isn't ready to share, and wouldn't be to useful in the case of a VPN.

The guide to start with is the LARTC HOWTO, but I don't believe it has any examples about how to create policies when a VPN is installed. Really though the fact that you are a using a VPN shouldn't matter. When OpenVPN is connected it just shows up as another network interface.

Improve this answer
1

Normal routing usually means looking at a destination to make a forwarding decisions. Policy routing usually means looking at a source and destination to make a forwarding decision (much more complicated.)

I might be wrong, but I think you may be able to segment your traffic using normal routing techniques.

Your VPN is probably for work??

Most corporate VPN policies want you to send all of traffic via their tunnel as a protection mechanism for them. (Someone external can't hack in to your box and then get access to the corp VPN.)

What I'm guessing you'd like (although it may not make your VPN admins happy) is to just send traffic for work-related sites via the VPN and all other traffic out your normal connection.

Take a look at your routing table. 'ip route'

Ideally you want to just route to the corporate networks via the vpn tunnel, and your default route will go out to your ISP.

Most VPN setups send a replacement default route, or openvpn will sometimes send two /1 routes to override your default route.

Without seeing your output of 'ip route', it's hard to recommend what to do next.

Can you share that?

Improve this answer
1
  • My vpn is to bypass censorship. My ip route shows: 192.168.1.0/24 dev eth2 proto kernel scope link src 192.168.1.105 metric 1 169.254.0.0/16 dev eth2 scope link metric 1000 default via 192.168.1.1 dev eth2 proto static Would you mind providing a description to this solution? I don't understand why INCOMING traffic to my original eth0 interface does not routed to my services. (Or is it that incoming traffic does reach my ip, but because my outgoing is tunneled to tun0 then the web service seems unresponsive per say?)
    – asdgas
    Jan 30, 2010 at 2:20
1

This isn't entirely simple, but here is a tutorial on having multiple default routes, that is, two routes reaching the entire internet:

http://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-routes-in-linux/

Once you've sorted out the routes, you can bind your bulk traffic to the ip of the physical interface and let everything else go through the vpn ip.

Improve this answer
1
  • I used above link to configure my openvpn client to run all traffic through the tun0 except for my webserver/sshd serve on eth0. perfect to outside work. thanks!
    – ikwyl6
    Apr 7, 2023 at 2:31

You must log in to answer this question.