0

I have CentOS Linux 6 based software router. I have 2 local networks, lets say Local1 and Local2. I have one Internet connection, and I have VPN connection that I run via this Internet one.

I use iptables and DHCP server to share Internet connection. When I enable VPN, both Local1 and Local2 traffic goes through VPN, without VPN both local networks go directly to Internet.

My question follows: how to set up CentOS based software router to forward one local network via VPN and another one directly?

Improve this question

4 Answers 4

Reset to default
0

I can't tell you how... but I can tell you theoretically.

Most likely, your VPN consists of only a specific network (or set of networks). You would want to set up Split Tunneling to say in Pseudo: "Any traffic destined for 'VPN network,' go through VPN Connection." Then your 0.0.0.0 default route would be all set up to go out through the internet connection.

I also believe priority matters. Be sure the route for the VPN Network has a higher priority than your default route.

Improve this answer
1
  • VPN connection used to anonymize Internet access in this software router; it is created to access Internet, not the resources inside the VPN. So, we can not route traffic based on its destination; we have to route it based on source, it is what I don't know how to do.
    – Vitalii
    Aug 15, 2016 at 19:05
0

First you have to change VPN configuration to not setup itself as a default gateway. What VPN is this? Second you have to add iptables rule to forward traffic from Local2(eth0) to VPN(tun0) ex.commands: iptables -I FORWARD -i eth0 -o tun0 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT and second iptables -t nat -I POSTROUTING -o tun0 -s 192.168.0.0/24 -j MASQUERADE

Improve this answer
2
  • My VPN is OpenVPN (from offficial CentOS repository). About these rules, may you explain how they will work? So, the first rule, we just allow forwarding eth0 to tun0 (but we don't force, so if default root is direct Internet connection and not VPN, how can we guarantee that iptables will use this rule?) 2nd rule is required to share connection, no questions. I think that the 1st rule will simply be ignored by router.
    – Vitalii
    Aug 16, 2016 at 5:26
  • If its Openvpn working as client the probably is getting directive redirect-gateway and set default route to vpn tunnel. Then indeed you have to make static routes for your both local networks.
    – Jakub Pisarczyk
    Aug 18, 2016 at 13:38
0

Finally I found a way. It is required to use iproute2, but some not obvious things are present.

  1. Use ip rule to create source-based routing policy.
  2. Use ip route .... table to add 3 routs to source-based routing policy: one that sets Internet default gateway, and 2 ones that set gateways for both local networks. It doesn't work without local networks gateways setup, probably because OpenVPN makes a lot of changes in routing table.
  3. Important: ip rule and ip route don't persist, so the rules disappear on reboot. It is common to use rule-interface and route-interface files to set static routes. However, these files are problematic when you use them with DHCP and/or Wi-Fi hotspot. The reason is that these files are applied in parallel to (so some times before) DHCP and hostapd initialization. That is why these 2 files result in incorrect routing table often. I use rc.local to add routes and rules with command line on system startup instead, and with this approach I am able to route one local NIC via VPN and another one directly.
Improve this answer
0

You need to use VPN without default gateway defined, so all your traffic will goes through old default gateway.

Then you can add the static route which will forward traffic to the local1 subnet to the VPN gateway.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .