Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We used to have 1 VPN tunnel over 1 Internet connection, connecting 2 datacenters into 1 virtual LAN (10.x.x.x). It was very simple with route tables etc.

Now that we added another tunnel on the second independent physical connection it becomes very difficult to handle routing. It's easy enough to route everything the new connection, but what if we want to route only specific host to host or subnet to subnet??

client1-site1 <--> vpn-on-site1 <--tun1--> vpn-on-site2 <--> service1-on-site2  
client2-site1 <--> vpn-on-site1 <--tun2--> vpn-on-site2 <--> service2-on-site2

Note that there is only 1 vpn node on each side. What we manage to do is for packets to be routed properly from client2-site1 to service2-on-site2 but the returning packets go sometimes to tun1...

share|improve this question
Please further elaborate. For example: What OS/Software are you running? – MichelZ Jul 18 '12 at 8:34
Linux and OpenVPN. – Alex Jul 19 '12 at 2:50
When you say two independent connections, please list from what to where is the physical side. Is this connected into 1 linux box with 2 nics? – Andy Jul 24 '12 at 13:36
Please describe the subnets used by the sites and the VPNs, and any NATing which is setup. – mgorven Jul 29 '12 at 7:43
up vote 2 down vote accepted

you need ip rules + iptables and ip route tables. 2 route tables:

1st -- with default output via tun1. 
2nd -- with default output via tun2.

When packet is received on tun1 -> iptables mangle mark it as 0x1, then ip rule routes it via mark 0x1 to the 1st route table. So when answer will be given packet would go via interface it was received, not default one.

Same logic for tun2.

I dont know, if this helps, but try also with rp_filter=0 (this kernel option to answer on interface packet was received, helps with LAN's)

I've done something similar, here is article ive found and repost on my old lj. Haven`t found source yet.

check this article, ive reposted on lj

share|improve this answer
Thank you very much, this is what I have been thinking too (routes + iptables), but my knowledge of these is quite basic. Could you please provides examples of commands to "mangle mark it as 0x1, then ip rule routes it via mark 0x1 to the 1st route table" , or perhaps a link to article with similar commands. – Alex Jul 26 '12 at 7:43
i've updated my answer with article i've founded some years ago. – MealstroM Jul 26 '12 at 7:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.