Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there any way to restrict a VPN client to only route certain traffic via the VPN and the rest via their local gateway?

For example: traffic to a certain IP or domain gets routed across the VPN and all other requests do not.

Let me know if you need more details.

Thank you.

share|improve this question

4 Answers 4

I see this question tagged as openvpn, so I'Lll give an openvpn answer.

In openvpn you can make server "push" certain routes to the clients

openvpn server.conf

push "route 192.168.2.0 255.255.255.0"
push "route 1.2.3.0 255.255.255.0"

The client must have 'pull' in its config file.

see man openvpn(8) under --pull and --push

share|improve this answer
    
Thanks Aleksandar. I ran through the openvpn man pages and I am still unable to find how to only pass traffic to a FQDN (or even a specific URI) via the VPN, while the rest of the traffic is routed via the client's standard gateway. –  mr-euro Sep 18 '09 at 9:07
2  
on a vpn level you can't do it by FQDN or URI, only per IP address, thats all a VPN knows about i.e. if you only want to route serverfault > host serverfault.com serverfault.com has address 69.59.196.212 your push will then be push "route 69.59.196.212 255.255.255.255" –  Aleksandar Ivanisevic Sep 21 '09 at 14:40

Sure, you just add route commands to the openvpn configuration. Let me know if you need more details.

share|improve this answer
    
Hi womble, Would it be server side then? I would have thought that the configuration had to made client side. I would appreciate more details. If you have a short example if would be even greater. Thank you! –  mr-euro Sep 17 '09 at 13:02
up vote 0 down vote accepted

It does not seem to be possible to only route traffic to a certain FQDN via the VPN. The alternative of using the IP address is not sufficient in this case as it can change. Thank you anyhow.

share|improve this answer
    
Did you find a way to do this? –  rmarimon Jan 25 '11 at 20:58

Could you be asking about "split-tunneling"... http://en.wikipedia.org/wiki/Split%5Ftunneling

ipUnplugged Mobile VPN from Radio IP Software. This is an IPSec mobile VPN based on Mobile IP standards and is always on. The user doesn't have to start/stop the VPN; it is intelligent enough to know when the user is in the office and when they are outside your secure network. www.ipunplugged.com

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.