3

Is there any way to restrict a VPN client to only route certain traffic via the VPN and the rest via their local gateway?

For example: traffic to a certain IP or domain gets routed across the VPN and all other requests do not.

Let me know if you need more details.

Thank you.

4 Answers 4

4

I see this question tagged as openvpn, so I'Lll give an openvpn answer.

In openvpn you can make server "push" certain routes to the clients

openvpn server.conf

push "route 192.168.2.0 255.255.255.0"
push "route 1.2.3.0 255.255.255.0"

The client must have 'pull' in its config file.

see man openvpn(8) under --pull and --push

2
  • Thanks Aleksandar. I ran through the openvpn man pages and I am still unable to find how to only pass traffic to a FQDN (or even a specific URI) via the VPN, while the rest of the traffic is routed via the client's standard gateway.
    – mr-euro
    Sep 18, 2009 at 9:07
  • 2
    on a vpn level you can't do it by FQDN or URI, only per IP address, thats all a VPN knows about i.e. if you only want to route serverfault > host serverfault.com serverfault.com has address 69.59.196.212 your push will then be push "route 69.59.196.212 255.255.255.255" Sep 21, 2009 at 14:40
0

Sure, you just add route commands to the openvpn configuration. Let me know if you need more details.

1
  • Hi womble, Would it be server side then? I would have thought that the configuration had to made client side. I would appreciate more details. If you have a short example if would be even greater. Thank you!
    – mr-euro
    Sep 17, 2009 at 13:02
0

It does not seem to be possible to only route traffic to a certain FQDN via the VPN. The alternative of using the IP address is not sufficient in this case as it can change. Thank you anyhow.

2
0

I'm using FreshTomato here. I managed to only redirect 3 destination IPs to the VPN.

Below is the OpenVPN custom configuration:

allow-pull-fqdn
route-nopull
script-security 2
up /opt/openvpn-routes.sh

Then the script mentioned above:

root@router:/tmp/home/root# cat /opt/openvpn-routes.sh 
#!/bin/sh
ip route add 204.11.51.251/32  dev tun11 # www.linksysinfo.org
ip route add 201.54.48.99/32   dev tun11 # www12.senado.leg.br
ip route add 34.160.111.145/32 dev tun11 # ifconfig.me

The /opt mount point was set up following the instructions from https://github.com/Entware/Entware/wiki/Install-on-TomatoUSB-and-FreshTomato

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .