Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to configure OpenVPN clients to route traffic for HTTP port 80 and HTTPS port 443 directly (i.e. not through the VPN), but through the regular default gateway the clients have. All other traffic should go through the VPN.

My client is running OpenVPN on Windows and my current configuration looks like this:

client
dev tun
proto tcp
remote my-server-2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ../keys/ca.crt
cert ../keys/client1.crt
key ../keys/client1.key
ns-cert-type server
verb 3
route-metric 1
show-net-up
dhcp-renew
dhcp-release
route-delay 0 120
hand-window 180
management localhost 13010
management-hold
management-query-passwords
management-forget-disconnect
management-signal
auth-user-pass
share|improve this question
    
This is not supported by default. First of all what operating system the clients are running? What is your current configuration? –  cstamas May 13 '12 at 18:52
    
my client is running openvpn on windows and my current configuration for it looks like that: client dev tun proto tcp remote my-server-2 1194 resolv-retry infinite nobind persist-key persist-tun ca ../keys/ca.crt cert ../keys/client1.crt key ../keys/client1.key ns-cert-type server verb 3 route-metric 1 show-net-up dhcp-renew dhcp-release route-delay 0 120 hand-window 180 management localhost 13010 management-hold management-query-passwords management-forget-disconnect management-signal auth-user-pass –  moti May 13 '12 at 19:20
    
my client is running openvpn on windows and my current configuration is basically dev tun and is aimed for users that will connect from anywhere (road warrior) the server iptable is configured for port forwarding, the problem is that i need to get the real ip's for the clients that go out for port 80, this is why i wan't to avoid using openvpn on port 80, although i don't mind using openvpn for port 80 as well, as long as the ip's that will leave my server will be the real ip's of the connected clients instead of the one server ip. –  moti May 13 '12 at 19:30

3 Answers 3

OpenVPN isn't able to filter traffic -- it simply sends the IP packets it is passed over the VPN tunnel. The functionality you want needs to be provided by the operating system. The OS needs to decide whether to route a packet using OpenVPN or using the gateway on the local network. On Linux one would accomplish this using iptables to mark certain packets, and iproute2 to select different routing tables. As far as I know this can't be done on Windows however.

share|improve this answer
    
is it possible to change the openvpn server to forward connections for port 80 for example, with external ip instead of the internal ip –  moti May 14 '12 at 13:22
    
OpenVPN doesn't filter, the next logical addendum is to use a Proxy server in the local network. Use a proxy configuration for your client browser(s) to go through the LAN Proxy Server. –  samt Mar 3 at 3:57

When you connect to the VPN it makes some changes to your routing table to decide which traffic goes to the openvpn interface and which traffic is sent to the local gateway.

It can be configured a couple of ways, 2 of which are as follows. (i think you need to google for "split tunnel" configurations for more details.)

1) (The default) configuration is for the server to push to the client a routing table entry with the tun interface gateway as the default route, in this scenario all traffic (including port 80 and 443) is routed via the openVPN tunnel.

2) What (I think) you want is to configure that upon connection the openVPN server to push only a route for the private network traffic to the routing table, so everything else is sent to the local gateway. (http, httpd, dns stays local)

Typically this involves setting the directive push in the server.conf file;

 push "route 10.251.69.0 255.255.255.0"

There is an example to disable "Should clients' Internet traffic be routed through the VPN?" on the openvpn web admin panel here

You can also make the setting on a per client basis, however according to the blog post linked in the comments, it is hard (impossible??) to unset the routes pushed from the server without running some bash script to wrap that. (Hence easier if you can set this the same for all clients in server.conf).

share|improve this answer
    
dltj.org/article/openvpn-split-routing "in its default configuration it would send all traffic — even that not destined for the machine room network — through the VPN. Since most of what I do doesn’t involve servers in the machine room, I wanted to change the configuration of the OpenVPN client to only send the machine room traffic through the VPN and everything else through the (original) default gateway. As it turns out, this involves tweaking the routing tables." –  Tom H May 13 '12 at 23:57
    
as @mgorven mentions, if you need to split traffic within a subnet then you would have to resort to firewall/nat filtering, or some sort of proxy server to filter the traffic. –  Tom H May 14 '12 at 0:01

If your OpenVPN client lives in your LAN gateway, you can do the following.

Mark incoming http-traffic with iptables

(iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 0x80.

Then create routing table specially for marked traffic.

echo "80 http" >> /etc/iproute2/rt_tables

ip route add default 11.22.33.44 dev ethX table http

And finally, add the rule for routing marked traffic according to brand new table.

ip rule add fwmark 0x80 lookup 80

You can learn more about Linux policy routing in Linux Advanced Routing and Traffic Control Howto - http://www.lartc.org

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.