Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have access to two gateways - one a slow VPN and the other a fast connection which blocks some hostnames (I'm behind the great firewall of china (gfw)).

I'd like to set up something (a tunnel / router / proxy) which would receive requests, and if they match one of the blocked hostnames, send them to the VPN, otherwise, send them to the fast local connection. I have Linux and Windows servers to use for this, and various routers (tomato).

The solution can be a router, or a program intercepting requests and redirecting them, or even something which just automatically creates route statements.

Having a VPN is really common here to route around the gfw, but it seems really inefficient to use it for everything. I'd also just appreciate pointers to the right terminology for what I'm looking for.

share|improve this question
Do you need something just for web access, or for everything? – Flimzy Jun 30 '11 at 8:29
just web would be ok. But, I don't want to have to maintain the VPN-required list of sites on the users' computer unless that can be really easy. I guess for that you could have them install a proxyswitch-like thing and have it sync to a .pac file? – fastmultiplication Jun 30 '11 at 8:32
I know you can set up squid to do that sort of thing. Of course, you'd have to maintain that list in squid--unless you can find a list somewhere else that you can import into squid somehow. Squid would take care of HTTP, FTP, and gopher (yay!) – Flimzy Jun 30 '11 at 8:38
Ok I'll check squid out. – fastmultiplication Jun 30 '11 at 8:39

This is sort of problem cannot be solved on network layer for obvious reason. What you need in my opinion is to have two simple forwarding proxies. One fetching the pages over the wire other via VPN. In front of that setup you should put a Varnish instance. You can setup varnish to fallback to other backend if one fails, which is exactly what is needed in your configuration. Your clients should use Varnish as a proxy.

Such setup won't require any kind of list.

share|improve this answer
that sounds like it could work, but does that mean that every time you request a blocked site you'd have to wait for it to timeout? That would be annoying. – fastmultiplication Jun 30 '11 at 9:02
You can setup a very low timeout to overcome that issue, and setup Varnish to force the failover backend permanently after first fail. Its a caching proxy after all, so it will serve lots of content from the cache. Also - I believe that the list of blocked sites is pretty short and the majority of traffic will omit the VPN. I cannot think of a better way to solve such issue without a need to maintain a list of blocked sites or whatnot. – mdrozdziel Jul 2 '11 at 9:24
up vote 0 down vote accepted

ok, this is solved now. Our setup is a tomato router which has ssh access enabled, and which is set to automatically start up a strongvpn client.

Once that's up, you log in and make it so that the vpn is still up, but doesn't route traffic by default (I couldn't find any settings in tomato for this), so I just do:

route del -net netmask

Then you have to set up routing for each of the hostnames that should go through the vpn (ones blocked in china).

There is a script running every few minutes which does dns lookups on everything in the list. For each dns it adds a route to the router like this:

ssh root@192.168.20.X route add -host [IP] tun12;

The router uses google dns and

and it's important to set those IPS to go through the VPN so that the gfw DNS blocker can't hit them (which only applies to sites they really don't like)

So the result is a no configuration wireless route around the gfw!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.