‾‾|‾‾‾                                           ______|Server|-


So I'm trying to set this up (A):
|          |            |
|         eth0--tun0    |
|          |      |     |
|   apache-|      |     |
|   ssh----|      |     |
|                 |     |

But, this is what I'm getting (B) :
|          |            |
|         eth0--tun0    |
|                 |     |
|   apache--------|     |
|   ssh-----------|     |
|                 |     |

 eth0     Link encap:Ethernet  HWaddr 00:xx:xx:xx:xx:xx
          inet addr:  Bcast:  Mask:

 tun0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:  P-t-P:  Mask:

 $route -n:
 Destination     Gateway         Genmask         Flags Metric Ref    Use Iface       UG    0      0        0 tun0         UG    0      0        0 eth0     U     0      0        0 tun0
 <VPN IP> UGH   0      0        0 eth0       UG    0      0        0 tun0   U     1      0        0 eth0


As soon as I start the openvpn service, I get the setup described in case B. Any trafic to/from the server uses the tun0 interface (and thus gets VPNd).

So, how do I make all trafic default to the eth0 interface, except trafic explicitly routed to tun0?

I tried setting the metric on tun0 to 100, using ifmetric after the openvpn service is started and set up. Trafic still defaults to tun0 however.

Is there maybe a conf value I can put in the .conf run by openvpn?

iptables is confed to route trafic from to tun0.


It appears as if the server has:
push "redirect-gateway tun0" or some similar config that is causing the all traffic to go through the tun0 connection. You should be able to remove that rule and just push the subnets you need routed explicitly.

The following routing rule is the problem: UG 0 0 0 tun0

| improve this answer | |
  • So I tried manually removing this rule, using "sudo route del default gw netmask" & doing a network-service restart. And it disappears from the list. But trafic is still redirected. – Darajan Dec 8 '15 at 8:34
  • 1
    I am not sure how you are starting the VPN, but doing a network service restart will likely undo any route changes you have made. As I stated in the answer if you want to "fix" this (ie not have to do extra stuff) changes should be made on the server side. – Eddie Dunn Dec 8 '15 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.