I have a simple mesh VPN (realized with Tinc) which contains my personal laptop and a VPS with a public IP. Let's say that the server's public IP is The private address of the laptop is and the private address of the server is

I'd like to route ALL the traffic from my laptop through the VPN and make it exit from the VPS. I have already setup the server to act as a gateway, by enabling forwarding and masquerading, but I can't figure out how to configure routing on the laptop.

The problem is that the laptop has no fixed local subnet. Sometimes it might be the of my house's router, or it might be the of my university, for example.

I'd like my laptop to route all my traffic through the VPN gateway, but at the same time, I should be able to access local network even if it has an unknown changing subnet.

This is what I managed to accomplish:

# ip route
default via dev wlan0 via dev vpn via dev vpn dev vpn  proto kernel  scope link  src dev wlan0  proto kernel  scope link  src

Following some OpenVPN guides, i split the entire internet in two big /1, so that they act as a sort of default route, without changing the actual default route (default via dev wlan0). The problem is that even the packets destined to the VPS at are captured by the /1 routes, and the traffic gets stuck.

If there was the possibility to write something like:

ip route add via default

It would be nice, but don't think is possible.

I even tried with policy-based routing and marking packets with iptables, but I had no luck.


Without knowing your actual VPS IP address I can't give you the exact commands but basically you need to split "the internet" into more pieces none of which include your VPS. For example if your VPS address is (which it obviously isn't) then you would have

  • via dev vpn
  • via dev vpn
  • via dev vpn
  • via dev vpn

note that this covers all of your second internet chunk EXCEPT for your VPS address. Mind you I intentionally picked an easy address so that I wouldn't be here all day but you can do it for anything you want if you are willing to write enough routes and you should only have to do it once as long as your VPS address doesn't change.

| improve this answer | |
  • That solution worked perfectly, thank you! Generating all the subnets by hand was error-prone, so I searched the web for something that could help, and I discovered ipcalc. ipcalc - and ipcalc - together gave all the subnets that I need! – Marco Cameriero Nov 20 '15 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.