Is there any way to restrict a VPN client to only route certain traffic via the VPN and the rest via their local gateway?

For example: traffic to a certain IP or domain gets routed across the VPN and all other requests do not.

Let me know if you need more details.

Thank you.


I see this question tagged as openvpn, so I'Lll give an openvpn answer.

In openvpn you can make server "push" certain routes to the clients

openvpn server.conf

push "route"
push "route"

The client must have 'pull' in its config file.

see man openvpn(8) under --pull and --push

| improve this answer | |
  • Thanks Aleksandar. I ran through the openvpn man pages and I am still unable to find how to only pass traffic to a FQDN (or even a specific URI) via the VPN, while the rest of the traffic is routed via the client's standard gateway. – mr-euro Sep 18 '09 at 9:07
  • 2
    on a vpn level you can't do it by FQDN or URI, only per IP address, thats all a VPN knows about i.e. if you only want to route serverfault > host serverfault.com serverfault.com has address your push will then be push "route" – Aleksandar Ivanisevic Sep 21 '09 at 14:40

Sure, you just add route commands to the openvpn configuration. Let me know if you need more details.

| improve this answer | |
  • Hi womble, Would it be server side then? I would have thought that the configuration had to made client side. I would appreciate more details. If you have a short example if would be even greater. Thank you! – mr-euro Sep 17 '09 at 13:02

It does not seem to be possible to only route traffic to a certain FQDN via the VPN. The alternative of using the IP address is not sufficient in this case as it can change. Thank you anyhow.

| improve this answer | |

Could you be asking about "split-tunneling"... http://en.wikipedia.org/wiki/Split_tunneling

ipUnplugged Mobile VPN from Radio IP Software. This is an IPSec mobile VPN based on Mobile IP standards and is always on. The user doesn't have to start/stop the VPN; it is intelligent enough to know when the user is in the office and when they are outside your secure network. www.ipunplugged.com

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.