Bypass VPN for HTTP/HTTPS traffic on Ubuntu?

Question

I have an Ubuntu 14.04 machine that all it's outgoing traffic is through a VPN, and I'm required to make sure that HTTP and HTTPS traffic don't go through the VPN.
I've looked into static routing but it seems to handle only layer 3.
How should I approach this setting? Thanks.

Answer 1

In order to route packets destined to specific ports via a different default gateway you need to mark those packets using iptables and then route them via a different route table.

So, first create a new route table with default gateway your local gateway (not your VPN gateway)

ip route add table 4 default via 192.168.0.1

Then mark the packets you need based on the destination ports.

iptables -t mangle -A PREROUTING -p tcp --dport 80  -j MARK --set-mark 4
iptables -t mangle -A PREROUTING -p tcp --dport 443 -j MARK --set-mark 4

Finally route those marked packets via the newly created route table.

ip rule add fwmark 4 table 4

I havent' tested the commands above so they may need a little tweaking.

Answer 2

One way you could do it is using ip rule and iptables. An example would be to mark the traffic you are interested to route

iptables -I OUTPUT -m tcp -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x0001

Then you create a new routing table:

echo 101 r_http >> /etc/iproute2/rt_tables
ip route add default via 10.0.0.1 dev eth0 table r_http
ip route flush cache

And now that you have your HTTP and HTTPS traffic marked you can create a rule to apply that new routing table

ip rule fwmark 0x0001 table 101

That should work. As an exercise to the reader is how to make it permanent and how to create the default route :-)

Answer 3

Recently I faced a similar situation as the OP had. Thank to the answers provided by @Cha0s and @Pablo Martinez, I was able to make it work for my situation.

First, as they both said, we must have iptables rules to mark those packets which shouldn't go through VPN. @Cha0s was right to put the rules in the mangle table. According to iptables man page, you have to use mangle table to do -j MARK target.

On the other hand, @Pablo Martinez is correct to put them in the OUTPUT chain, even though iptables man page says you should use -j MARK in PREROUTING chain. Those packets are generated at local host and going out. They won't be processed by PREROUTING chain. But OUTPUT chain makes sense, and it also has a mangle table. So here is the iptables rule I used:

iptables -t mangle -I OUTPUT -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x101

Then create a new routing table and add a route to it as @Pablo Martinez described:

echo 101 r_http > /etc/iproute2/rt_tables.d/r_http.conf
ip route add table r_http default via 192.168.0.1 dev enp2s0
ip route flush cache

Replace 192.168.0.1 with the IP of your gateway or router (not VPN) and enp2s0 with your network interface name. You can use "ip addr" to check interface names.

Finally, add an ip rule to let iproute2 inspect the mark and use our new routing table.

ip rule add fwmark 0x101 table 101

You can add an iptables rule to log those packets going to port 80 and 443. Note that that rule is added to the top of OUTPUT chain in the filter table because filter table is processed after mangle table and it must be the first rule to avoid being ignored.

iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -j LOG --log-prefix "<HTTP/S>" --log-level info

The log entries should show up in the /var/log/kern.log (on a Debian system). You can check whether they all have MARK=0x101 in them. Don't forget to delete the rule for logging once you collect enough entries.

cat /var/log/kern.log | grep '<HTTP/S>' | less

Once you are sure packets are correctly marked, you can check whether iproute2 will picks the right route for marked packets.

ip route get to 8.8.8.8
ip route get to 8.8.8.8 mark 0x101

The result from the first line should tell you the packet will go through VPN gateway and tunnel device. The second line should show the packet will go through your own gateway and network device.

REFERENCES:

• Man page iptables-extensions.
• Man page ip-route and ip-rule.
• An In-Depth Guide to iptables, the Linux Firewall.
• A Deep Dive into Iptables and Netfilter Architecture.

Answer 4

You could try configuring your browsers to use a proxy.
- You can specify proxy in DNS, but I'm not familiar with this technique. (How DNS lookups work when using an HTTP proxy (or not) in IE) - This can also be done with Group Policy (http://social.technet.microsoft.com/wiki/contents/articles/5156.how-to-force-proxy-settings-via-group-policy.aspx), and if the browsers in question respect the settings in Internet Explorer, you can easily deploy it across the entire network.

You'll need an HTTP proxy server for this to work though (https://stackoverflow.com/questions/1994846/open-source-http-or-https-proxy)

This would keep web browser traffic off the VPN, but everything else should be fine. Set your proxy server up in such a way that none of the traffic is routed through the VPN.