Traffic refuses to go over VPN interface

Question

I've set up a VPN tunnel, and encountered an interesting issue.

With fixed routes set up (say, to 8.8.8.8), everything is fine. Packets get sent over that interface, and responses are received. The same when a default gateway is set up.

The problem occurs when there is no route set up, but an application is bound to that interface. If I try to use ping -I tun0 8.8.8.8, tcpdump shows no packets actually being sent over the tunnel at all.

More importantly, when I use curl --interface tun0 google.com, tcpdump appears to show that a SYN is sent, and a SYN-ACK is received... but then appears to be dropped. The connection eventually times out.

My goal is to have traffic from applications bound to that interface routed exclusively over that interface, and all other traffic out the default gateway. I can't set the default gateway to the VPN.

Is there something simple that I'm missing?

Answer 1

You need to set up an additional routing table for that interface.

I assume that your tunnel has ip address 10.10.0.10, subnet 255.255.255.0 and gateway 10.10.0.1.

1. Edit /etc/iproute2/rt_tables and add a new routing table with name rt_tunnel and preference 1 at the end

   1  rt_tunnel
   

2. Configure the routing table. We add the reachable network and its default gateway

   ip route add 10.10.0.0/24 dev tun0 src 10.10.0.10 table rt_tunnel
   ip route add default via 10.10.0.1 dev tun0 table rt_tunnel
   

3. Add routing rules, so the system know when to use the new routing table

   ip rule add from 10.10.0.10/32 table rt_tunnel
   ip rule add to 10.10.0.10/32 table rt_tunnel