-1

My question is simple, but I couldn't find a clean, step_by_step guide/example on the Internet. I have an OpenVPN proxy server and I want to just route the web traffic of my local Ubuntu machine through it.I know we can route just a specific destination(IP or network) through OpenVPN by changing the client.config(here). But for a specific traffic such as web(80/443) I know that I should add route-nopull to the client.config and also add some iptables rules by marking web traffic and route it to the OpenVPN gateway but I'm not sure how to do it. Any suggestion would be a great help.

2 Answers 2

0

Use rule-based policy routing.

Netfilter will add mark to packets:

iptables -t mangle -A PREROUTING -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x1

then Linux should be told if it sees this mark it should use alternate routing table:

ip rule add fwmark 0x1 lookup 201

and you need a route in that table:

ip route add default via [your-openvpn-peer-address] table 201

Beware you still can be tracked by non-standard ports and DNS queries. It is easy to also route all or some of them with same method - just add more netfilter mark rules.

You could also use symbolic alias instead of kernel table number.

echo "201 route-via-vpn" >> /etc/iproute2/rt_tables

then use "route-via-vpn" table name instead of the number in all ip subcommands: ip rule add ... lookup route-via-vpn, ip route add ... table route-via-vpn.

Probably you will need to run netfilter, ip rule and ip route commands automatically once tunnel is established and run reverse commands (iptables -D, ip rule delete or ip route delete) when it is shutdown. This could be done with OpenVPN scripting.

Setting up OpenVPN peer to forward your packets is up to you.

4
  • is the [your-openvpn-peer-address] the public address my openvpn server? or it's the ip address of openvpn on tun0?
    – Alex
    Jun 2, 2016 at 15:15
  • Thanks for your detailed explanation. I connect to the VPN server : 'sudo openvpn --route-nopull --config client.ovp' without pulling any route from the server. tun0 is up and I can ping the openvpn ip ( ping 10.8.0.1). I followed the above instruction but the web traffic does not go through the openvpn server and it still goes to the previous interface.What's the problem?
    – Alex
    Jun 2, 2016 at 18:08
  • Finally this one worked for me: (I used the above answer and also added something to it so finally it worked for me, so in total I did): *iptables -t mangle -A OUTPUT -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x1 *iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE *sysctl -w net.ipv4.conf.tun0.rp_filter=2 *ip rule add fwmark 0x1 lookup 201 *ip route add default dev tun0 table 201
    – Alex
    Jun 5, 2016 at 16:40
  • After you set up VPN, you should never need to use public addresses at all, that is the primary point to use VPN after all. Peer address is inside-vpn address of course. In OpenVPN, that could mean virtual address which is assigned as peer address on tun or tap interface. That address could belong to OpenVPN process itself if you're using default "net30" topology. Jun 8, 2016 at 5:56
0

Thanks for the above answer, but what worked for me is:

iptables -t mangle -A OUTPUT -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
sysctl -w net.ipv4.conf.tun0.rp_filter=2
ip rule add fwmark 0x1 lookup 201
ip route add default dev tun0 table 201

Not the answer you're looking for? Browse other questions tagged .