Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up a IPIP tunnel between my workstation and my server. I can add routes manually to have traffic going through the tunnel like this:

ip route ad dev foo

I'm not sure however how I should configure my routes to have all my traffic (except traffic for the local network going through the tunnel.

share|improve this question

other posters are right - you route all traffic via tunnel... except traffic to the other endpoint of tunnel that should go via public internet.

ip route del default
ip route add default via dev tun0
ip route add via dev eth0

[ example assumes that you terminate tunnel at; your local gateway is at; your far end address of vpn tunnel tun0 is ]

if you use openvpn - here's the description.

share|improve this answer

Finally, I did this, changing my default route:

route add default dev foo
ip route flush cache

share|improve this answer

You'll need to add a default route through dev foo. Dunno how you'd do it with ip, but with route you could do it with route add default dev foo.

share|improve this answer
Adding a default route is not sufficient as to reach the remote end of the tunnel, I need to follow what is my current default route. I hoped to be able to do it without touching my default route, so as to limit the changes needed to activate/deactivate the tunnel. – user10245 Jul 26 '09 at 13:06
But that's what the default route is for. Maybe setting multiple default routes with different metrics may help you to recover the old route. What kind of VPN solution do you use? OpenVPN has the possibility to push routes. The old route will be recovered after disconecting. – Manuel Faux Jul 26 '09 at 13:13
It's not possible to do without modifying your default route. You'll need to add a specific route to the tunnel endpoint, so traffic to the tunnel itself can be routed. – Cian Jul 26 '09 at 13:14

You have to set the default route of the workstation to the server:

route add default gw <server>

And also vice versa, if you want to do it symmetrically; but in this case you will have to configure the workstation to do routing.

share|improve this answer
setting only the default route only would render tunnel useless (as tunnel itself would have to go through the tunnel, it's nonsense situation) – asdmin Jul 27 '09 at 7:44
That is correct, but he said, he already set up the tunnel, so I assumed he already configured the basic routes through his network. – Manuel Faux Jul 27 '09 at 7:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.