Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got an Ubuntu 12.04 server running on Amazon's EC2 that runs a web crawling process. We're running into a problem where some of the webservers hosting the sites we need to crawl are blocking all EC2 IP addresses.

My brilliant idea was to tunnel outgoing HTTP requests through a VPN. I was able to get the VPN set up but it routed ALL traffic through the VPN which meant that I couldn't SSH into the machine and it wouldn't respond to any incoming http requests. (This server also hosts a web service that we need to be able to access)

Really I just want to "proxy" all outgoing HTTP requests through the VPN so we can access sites that have all EC2 IPs blocked.

It's very possible I'm going about this the wrong way and I welcome any other suggestions that might be simpler or more robust.

share|improve this question

What you need is source policy routing to route responses to incoming connections out the EC2 gateway instead of the VPN. Assuming that your instance's internal IP is with default gateway at, and VPN IP is

  1. Create named routing tables (only needs to be done once)

    echo 10 ec2 >> /etc/iproute2/rt_tables
    echo 11 vpn >> /etc/iproute2/rt_tables
  2. Configure the new routing tables with a default route over their respective gateways

    ip route add dev eth0 table ec2
    ip route add default via table ec2
    ip route add dev tun0 table vpn
    ip route add default via table vpn
  3. Add routing rules to select the correct routing table based on the source address

    ip rule add from lookup ec2
    ip rule add from lookup vpn

This should allow you to set the default gateway to be the VPN and still have incoming connections work.

What you could do instead however, is configure your application to explicitly bind to the VPN IP ( when creating outgoing connections, which will cause all connections from that application to go over the VPN, but all other outgoing connections go out directly. If you can't configure your application to bind to the VPN IP, you could add an HTTP proxy server to do this part.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.