I'm using openvpn to route all user traffic over a server in an encrypted fashion when the user is connected to untrusted networks.
- The openvpn gateway is 10.8.0.5.
- The actual IP of the openvpn server is 22.214.171.124.
- The untrusted networks gateway is 126.96.36.199.
This is the routing table on the client
default via 10.8.0.5 dev tun0 proto static metric 50 default via 188.8.131.52 dev wlp6s0 proto static metric 600 184.108.40.206 via 220.127.116.11 dev wlp6s0 proto static metric 600
In general, this setup works fine. All traffic is being routed through the openvpn server.
Now, the user wants to send an email using the company smtp server, which happens to be the same machine that the openvpn server is running on (=> same ip).
Because of the 3rd rule in the routing table, this traffic is now being routed through the untrusted network, which results in two problems:
- traffic is not protected by the vpns encryption
- if the untrusted network is only whitelisting port 80/443 or blocking smtp ports, the user cannot send his email
How can I mitigate this problem? Using a different IP for the vpn&smtp server is not a possibility.