I'm using openvpn to route all user traffic over a server in an encrypted fashion when the user is connected to untrusted networks.
- The openvpn gateway is 10.8.0.5.
- The actual IP of the openvpn server is 50.1.1.1.
- The untrusted networks gateway is 20.1.1.1.
This is the routing table on the client
default via 10.8.0.5 dev tun0 proto static metric 50
default via 20.1.1.1 dev wlp6s0 proto static metric 600
50.1.1.1 via 20.1.1.1 dev wlp6s0 proto static metric 600
In general, this setup works fine. All traffic is being routed through the openvpn server.
Now, the user wants to send an email using the company smtp server, which happens to be the same machine that the openvpn server is running on (=> same ip).
Because of the 3rd rule in the routing table, this traffic is now being routed through the untrusted network, which results in two problems:
- traffic is not protected by the vpns encryption
- if the untrusted network is only whitelisting port 80/443 or blocking smtp ports, the user cannot send his email
How can I mitigate this problem? Using a different IP for the vpn&smtp server is not a possibility.