0

I have access to two gateways - one a slow VPN and the other a fast connection which blocks some hostnames (I'm behind the great firewall of china (gfw)).

I'd like to set up something (a tunnel / router / proxy) which would receive requests, and if they match one of the blocked hostnames, send them to the VPN, otherwise, send them to the fast local connection. I have Linux and Windows servers to use for this, and various routers (tomato).

The solution can be a router, or a program intercepting requests and redirecting them, or even something which just automatically creates route statements.

Having a VPN is really common here to route around the gfw, but it seems really inefficient to use it for everything. I'd also just appreciate pointers to the right terminology for what I'm looking for.

4
  • Do you need something just for web access, or for everything?
    – Flimzy
    Jun 30, 2011 at 8:29
  • just web would be ok. But, I don't want to have to maintain the VPN-required list of sites on the users' computer unless that can be really easy. I guess for that you could have them install a proxyswitch-like thing and have it sync to a .pac file? Jun 30, 2011 at 8:32
  • I know you can set up squid to do that sort of thing. Of course, you'd have to maintain that list in squid--unless you can find a list somewhere else that you can import into squid somehow. Squid would take care of HTTP, FTP, and gopher (yay!)
    – Flimzy
    Jun 30, 2011 at 8:38
  • Ok I'll check squid out. Jun 30, 2011 at 8:39

2 Answers 2

0

This is sort of problem cannot be solved on network layer for obvious reason. What you need in my opinion is to have two simple forwarding proxies. One fetching the pages over the wire other via VPN. In front of that setup you should put a Varnish instance. You can setup varnish to fallback to other backend if one fails, which is exactly what is needed in your configuration. Your clients should use Varnish as a proxy.

Such setup won't require any kind of list.

2
  • that sounds like it could work, but does that mean that every time you request a blocked site you'd have to wait for it to timeout? That would be annoying. Jun 30, 2011 at 9:02
  • You can setup a very low timeout to overcome that issue, and setup Varnish to force the failover backend permanently after first fail. Its a caching proxy after all, so it will serve lots of content from the cache. Also - I believe that the list of blocked sites is pretty short and the majority of traffic will omit the VPN. I cannot think of a better way to solve such issue without a need to maintain a list of blocked sites or whatnot.
    – mdrozdziel
    Jul 2, 2011 at 9:24
0

ok, this is solved now. Our setup is a tomato router which has ssh access enabled, and which is set to automatically start up a strongvpn client.

Once that's up, you log in and make it so that the vpn is still up, but doesn't route traffic by default (I couldn't find any settings in tomato for this), so I just do:

route del -net 0.0.0.0 netmask 128.0.0.0

Then you have to set up routing for each of the hostnames that should go through the vpn (ones blocked in china).

There is a script running every few minutes which does dns lookups on everything in the list. For each dns it adds a route to the router like this:

ssh [email protected] route add -host [IP] tun12;

The router uses google dns 8.8.8.8 and 8.8.4.4

and it's important to set those IPS to go through the VPN so that the gfw DNS blocker can't hit them (which only applies to sites they really don't like)

So the result is a no configuration wireless route around the gfw!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .