6

I have succesfully set up an openvpn connection. By using the parameters

redirect-gateway def1
dhcp-option DNS 10.8.0.1

all traffic will go through the VPN, but I only want a specific application (like a browser (eg. Firefox)) to use the openvpn connection. All other traffic should go through the regular gateway.

Can I use the socks/proxy settings to point it to the openvpn link somehow? Maybe I can use putty to create this link? If so, how?

By the way, this is on windows os.

4
  • Hmm. Kinda. I have looked through that post, But is "ForcebindIp" the only way to do this? Like I said, Im happy if only works with a browser. I don't want to do it ip-ranges routes exceptions style, just plain application forwarding.
    – droidgren
    Feb 25, 2013 at 19:55
  • The problem you're up against is that routing is done by target IP, not by source application. Regardless, the one I marked as a dupe is the same question (IMO anyway). If you would like different/better/newer answers to the question that already exists I'd suggest placing a bounty on it requesting more/different answers. Feb 25, 2013 at 20:04
  • 1
    This question differs in two ways: 1. I don't want use routing-tables 2. My question is about applications WITH proxy support like browsers.
    – droidgren
    Feb 25, 2013 at 20:12

3 Answers 3

4

I had specifically this problem and couldn't find an easy to use solution. Basically the approach is still to set up SOCKS server in the VPN server. I've made this Docker image to make it actually usable

https://hub.docker.com/r/kizzx2/openvpn-client-socks/

Start that and then set your browser to use SOCKS proxy at local.docker:1081

Most applications can be coerced to go through that even if there's no built in proxy configuration. See proxychains

0

Yes, you could use a SOCKS proxy (or a regular proxy), and simply make sure the traffic to that proxy goes across the VPN. [ Of-course, if you are using SSH, a VPN is redundant ]. You would want to remove the "redirect-gateway def1" statement, possibly leaving it out altogether or replacing it with "redirect-private".

You need to be aware that DNS traffic could leak out your existing network if your nameservers are not on the other side of the VPN.

Putty can be used to create a socks connection.

The Unix way (apparently works with Putty as well) - From the command line

putty -D 8080 username@remotehost

(Where 8080 is the SOCKS port)

The Windows way: From http://vectrosecurity.com/content/view/67/26/ (and repeated here in case that site goes away)

  1. Open PuTTY.
  2. Where it says 'Host Name (or IP address)' and has a box underneath it, enter the name of your SSH host into the box.
  3. Under 'Saved Sessions' enter a name for this connection that will help you remember it later. For example, you could call it 'SSH Proxy' so you know this will be the proxy connection.
  4. In the 'Category:' menu on the left, expand the 'Connection' menu list if it is not expanded already. Expand the 'SSH' menu list if that one is not expanded already. Click 'Tunnels' (underneath 'SSH'). This opens the options where you will enter the settings for PuTTY to create the tunnel.
  5. Under 'Add new forwarded port:' enter 9853
  6. Where it says 'Destination' leave that field blank but be sure to select the 'Dynamic' option underneath it.
  7. Click the 'Add' button to add this port.
  8. In the 'Category:' menu on the left, click the click 'Connection'.
  9. Where it says 'Seconds between keepalives (0 to turn off)' enter 5 in the box. This will keep your connection alive and prevent it from timing out even when you walk away from the computer for a while.
  10. In the 'Category:' menu on the left, click 'Session' at the very top to go back to the first screen.
  11. Click the 'Save' button to save all of the settings you just entered. Later you will not have to enter these settings again in the future, you will only need to load up your saved profile (by double-clicking it after you open PuTTY) every time you wish to connect to the proxy.
  12. Click the 'Open' button to open the connection to the proxy.
  13. When connected you will be asked for your username and password. Enter the username and password for your account. Once connected the tunnel is open. After you are finished using the tunnel, type logout and press Enter.
5
  • Sorry, What "remotehost" do you mean? the openvpn server? the openvpn network interface? Im not using SSH.
    – droidgren
    Feb 26, 2013 at 7:39
  • Yes, by remotehost I mean the remote ssh server. (I think you may be a bit confused - If you are using putty you are using ssh - by definition - putty is an SSH client which creates a socks tunnel across an SSH connection). Using putty and Socks is probably the easiest way to do what you want, otherwise you will need to fart around with a proxy server on the other side of the VPN. You will, however need an SSH server on the remote machine - of-course, you can get rid of the OpenVPN connection as SSH is doing pretty much the same thing for you.
    – davidgo
    Feb 26, 2013 at 8:04
  • Ok, but isn't openvpn faster than SSH tunnel? But ok looks like the only I can utilize my shiny new OpenVPN tunnel the way I want is by using ForceBindIP.. I thought it was possible could do "local proxy server" to funnel application traffic to OpenVPN connection.
    – droidgren
    Feb 26, 2013 at 8:13
  • Yes, OpenVPN is probably faster the SSH. Instead of funneling to a local proxy server, simply funnel to a proxy server on the other side of the VPN.
    – davidgo
    Feb 26, 2013 at 8:37
  • 1
    It’s SOCKS, by the way.
    – Daniel B
    Jul 7, 2014 at 12:49
-2

If you’re indeed specifically asking for applications that support proxy servers, the answer is quite easy: Use a proxy server!

Your VPN connection must be configured so that it doesn’t modify clients’ default gateway. This way, all traffic uses the regular route to the internet.

I’ll assume your VPN connection uses 10.20.30.0/24 as the subnet, with 10.20.30.1 being the server’s IP address.

Configure a proxy (squid, or maybe something lighter) on your VPN server and set it to listen for clients on 10.20.30.1. Point your browser (or whatever) at the proxy at 10.20.30.1. Traffic to this IP address will always be routed through your VPN connection.

2
  • a VPN is more secure than a proxy server because it can use certificates for authentication
    – knocte
    Mar 2, 2016 at 3:22
  • @knocte yeah, so? I'm saying to use both.
    – Daniel B
    Mar 2, 2016 at 6:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .