I've set up a VPN tunnel, and encountered an interesting issue.

With fixed routes set up (say, to, everything is fine. Packets get sent over that interface, and responses are received. The same when a default gateway is set up.

The problem occurs when there is no route set up, but an application is bound to that interface. If I try to use ping -I tun0, tcpdump shows no packets actually being sent over the tunnel at all.

More importantly, when I use curl --interface tun0 google.com, tcpdump appears to show that a SYN is sent, and a SYN-ACK is received... but then appears to be dropped. The connection eventually times out.

My goal is to have traffic from applications bound to that interface routed exclusively over that interface, and all other traffic out the default gateway. I can't set the default gateway to the VPN.

Is there something simple that I'm missing?


You need to set up an additional routing table for that interface.

I assume that your tunnel has ip address, subnet and gateway

  1. Edit /etc/iproute2/rt_tables and add a new routing table with name rt_tunnel and preference 1 at the end

    1  rt_tunnel
  2. Configure the routing table. We add the reachable network and its default gateway

    ip route add dev tun0 src table rt_tunnel
    ip route add default via dev tun0 table rt_tunnel
  3. Add routing rules, so the system know when to use the new routing table

    ip rule add from table rt_tunnel
    ip rule add to table rt_tunnel

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.