I'm trying to ensure that all traffic to our stats server is forced over the VPN, in the case that the VPN falls down, it shouldn't be that the traffic tries to route over the WAN. To short-circuit the DNS lookups we've listed the host in the hosts file, but it would resolve in the wider world, too.
Here's what we have:
$ echo "12.23.45.67 the.statsd.server" > /etc/hosts
# From a /etc/ppp/ip-up.d/thevpn (so it's a pptp client script that does this)
route add -host 12.34.45.67 dev ppp0
$ iptables -I INPUT -s 12.23.45.67 -i eth0 -j DROP
$ iptables -I OUTPUT -d 12.23.45.67 -o eth0 -j DROP
$ iptables -I OUTPUT -d 12.23.45.67 -o ppp0 -j ACCEPT
Everything up until IP tables works, but the problem (if it is indeed a problem) is that I can now no longer ping that host, even when the VPN is up:
root@li149-82:~# ping the.statsd.server
PING the.statsd.server (12.23.45.67) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
I'm not particularly skilled with IP tables, the key thing is that by default it should not be possible to route to that host, at all unless it's over ppp0
.