Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

whats the best way to configure openvpn clients to go selectively go about using an openvpn connection? i want to setup a vpn server for friends in china, but i dont want them to use it for everything, just so they can access sites like youtube, facebook, cnn, etc. while they are in china through the vpn (these are blocked).

it would be nice if the vpn was a backup, so for instance if they are trying to go to facebook (which is blocked), it would go through the vpn connection once finding that the normal connection does not work.

this would save a lot of bandwidth cost actually, and give them a better browsing experience.

is this a iptable route thing? or a dns server that i push to my clients?

share|improve this question
    
Can you tell us how China 'blocks'? Is it a 403, a 404, a 200 custome page, a connection reset or a connection drop? –  chmeee Apr 22 '10 at 13:10
    
@chmee: they use multiple ways, lately they send TCP RST packets. –  Dan Andreatta Apr 23 '10 at 11:19

3 Answers 3

I would suggest setting up a transparent Squid proxy on your end accessible through the VPN and not push any routes (besides the OpenVPN subnet obviously) and have them install something like FoxyProxy in Firefox as their proxy client. FoxyProxy supports patterns, so you can have them add the sites you want to proxy through your VPN for them (*.facebook.com, etc.).

You'll also have the benefit of logging (they're your friends, but still) and caching (at least saving you some upstream bandwidth) with Squid.

share|improve this answer
    
=1 I think a proxy is the best solution –  chmeee Apr 24 '10 at 13:38
    
i think ill take dan's advice. yours is an easier and possibly better solution, but I don't want to force them to install more client software than they have to. i was envisioning a click and go vpn simple solution. good recommendation though +1 –  mx2323 Apr 28 '10 at 18:52
    
FoxyProxy -- like all FireFox add-ons -- is simple/trivial to install. Doing it the "wrong" way so that your friends don't have to click a few times? Hey, it's your call. –  gravyface Apr 28 '10 at 19:23

You should be able to do that directly with OpenVPN. There are three steps: 1) tell the openvpn server about the new route, 2) tell the client kernel about the new route and 3) tell the kernel of the openvpn server about the new route

  1. add "route 69.63.189.16 255.255.255.255 " in the config file
  2. can be accomplished adding a "push "route 69.63.189.16 255.255.255.255""
  3. you have to create a client configuration file in the directory specified by the client-config-dir option and add the option "iroute 69.63.189.16 255.255.255.255"

add as many routes as you like, each one in all three places.

-- EDIT --

If you want to use DNS, you can add zones so that the sites that you want redirected appear to have VPN addresses, i.e. cnn.com -> 10.10.10.10, bbk.co.uk -> 10.10.10.11 and so on. Then at the firewall/router, you need to add NAT rules to translate those internal IP addresses to the real addresses again.

share|improve this answer
    
this means, a route for an ip 69.63.189.16 to 255.255.255.255. but if they type in cnn.com, their dns server won't know that the ip of cnn.com should be "69.63.89.16". so is there still a missing piece with regards to resolving that domain name to the ip of the route....? i see that i can push a dns server to the client.. is that the way to do it? –  mx2323 Apr 22 '10 at 23:01
    
It may work, however it will work only with Windows clients. You can create a fake authoritative server with the info you want, and reroute the DNS through it. –  Dan Andreatta Apr 23 '10 at 6:33
    
yea, this is the solution i will likely take.. thanks dan! –  mx2323 Apr 28 '10 at 18:53
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

must reconfigure dnsmasq and resolvconf - this may only work on windows clients.

However

push "redirect-gateway bypass-dhcp" 

might work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.