0

I have a simple mesh VPN (realized with Tinc) which contains my personal laptop and a VPS with a public IP. Let's say that the server's public IP is 1.2.3.4. The private address of the laptop is 10.16.1.2 and the private address of the server is 10.16.0.2.

I'd like to route ALL the traffic from my laptop through the VPN and make it exit from the VPS. I have already setup the server to act as a gateway, by enabling forwarding and masquerading, but I can't figure out how to configure routing on the laptop.

The problem is that the laptop has no fixed local subnet. Sometimes it might be the 192.168.0.0/24 of my house's router, or it might be the 172.16.0.0/12 of my university, for example.

I'd like my laptop to route all my traffic through the VPN gateway, but at the same time, I should be able to access local network even if it has an unknown changing subnet.

This is what I managed to accomplish:

# ip route
default via 192.168.0.1 dev wlan0
0.0.0.0/1 via 10.16.0.2 dev vpn 
128.0.0.0/1 via 10.16.0.2 dev vpn 
10.16.0.0/16 dev vpn  proto kernel  scope link  src 10.16.1.2 
192.168.0.0/24 dev wlan0  proto kernel  scope link  src 192.168.0.133

Following some OpenVPN guides, i split the entire internet in two big /1, so that they act as a sort of default route, without changing the actual default route (default via 192.168.0.1 dev wlan0). The problem is that even the packets destined to the VPS at 1.2.3.4 are captured by the /1 routes, and the traffic gets stuck.

If there was the possibility to write something like:

ip route add 1.2.3.4/32 via default

It would be nice, but don't think is possible.

I even tried with policy-based routing and marking packets with iptables, but I had no luck.

0

Without knowing your actual VPS IP address I can't give you the exact commands but basically you need to split "the internet" into more pieces none of which include your VPS. For example if your VPS address is 255.255.255.255 (which it obviously isn't) then you would have

  • 127.0.0.0/7 via 10.16.0.2 dev vpn
  • 255.0.0.0/15 via 10.16.0.2 dev vpn
  • 255.255.0.0/23 via 10.16.0.2 dev vpn
  • 255.255.255.0/31 via 10.16.0.2 dev vpn

note that this covers all of your second internet chunk EXCEPT for your VPS address. Mind you I intentionally picked an easy address so that I wouldn't be here all day but you can do it for anything you want if you are willing to write enough routes and you should only have to do it once as long as your VPS address doesn't change.

| improve this answer | |
  • That solution worked perfectly, thank you! Generating all the subnets by hand was error-prone, so I searched the web for something that could help, and I discovered ipcalc. ipcalc 0.0.0.0 - 1.2.3.3 and ipcalc 1.2.3.5 - 255.255.255.255 together gave all the subnets that I need! – Marco Cameriero Nov 20 '15 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.