Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I connect to a VPN using openVPN. Now, after the connection is established, all my traffic goes through tun0.

My LAN gateway is 10.100.98.4... So, for apps to use my direct internet connnection I did

sudo route add default gw 10.100.98.4

But, I cant use tun0 now. I know this because

curl --interface tun0 google.com

doesnt give me anything.. How do I go about using both connections simultaneously. How can I achieve that?

ROUTING TABLES:-

Without VPN running:-

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.100.98.0     *               255.255.255.0   U     1      0        0 eth0
default         10.100.98.4     0.0.0.0         UG    0      0        0 eth0

With VPN:-

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.0.1       10.10.54.230    255.255.255.255 UGH   0      0        0 tun0
10.10.54.230    *               255.255.255.255 UH    0      0        0 tun0
free-vpn.torvpn 10.100.98.4     255.255.255.255 UGH   0      0        0 eth0
10.100.98.0     *               255.255.255.0   U     1      0        0 eth0
default         10.10.54.230    0.0.0.0         UG    0      0        0 tun0

After the route command-

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.0.1       10.10.54.230    255.255.255.255 UGH   0      0        0 tun0
10.10.54.230    *               255.255.255.255 UH    0      0        0 tun0
free-vpn.torvpn 10.100.98.4     255.255.255.255 UGH   0      0        0 eth0
10.100.98.0     *               255.255.255.0   U     1      0        0 eth0
default         10.100.98.4     0.0.0.0         UG    0      0        0 eth0
default         10.10.54.230    0.0.0.0         UG    0      0        0 tun0
share|improve this question
    
I am on ArchLinux –  shadyabhi Jan 14 '11 at 13:19

1 Answer 1

up vote 1 down vote accepted

After adding the default route, you're telling all your traffic to go back out of the gateway, so you're only going to get odd things happening.

If you have a particular network at the other end of your VPN that you need access to, you want to be adding specific routes to point at tun0. You can either do this manually by adding routes after the tunnel has come up, or better still change OpenVPN's server.conf file to 'push' the routes out to you when the tunnel comes up.

If you're wanting to do something a bit more complicated - say you're wanting to force all port 80 and 443 traffic down the VPN but make everything else go out of eth0 - then you could use iptables to source NAT traffic matching particular rules to the IP address of tun0 - something a bit like this:-

iptables -t nat -A POSTROUTING -s 10.10.98.0/24 -d ! 10.10.98.0/24 -p tcp --dport 80 -j SNAT --to-source 10.10.54.230
iptables -t nat -A POSTROUTING -s 10.10.98.0/24 -d ! 10.10.98.0/24 -p tcp --dport 443 -j SNAT --to-source 10.10.54.230

To make this persistent, as root, iptables-save > /etc/iptables/iptables.rules.

Good luck!

share|improve this answer
    
[shadyabhi@archlinux ~]$ sudo iptables -t nat -A POSTROUTING -s 10.10.98.0/24 ! -d 10.10.98.0/24 -p tcp --dport 80 -j SNAT --to-source 10.100.98.4 [shadyabhi@archlinux ~]$ sudo iptables -t nat -A POSTROUTING -s 10.10.98.0/24 ! -d 10.10.98.0/24 -p tcp --dport 443 -j SNAT --to-source 10.100.98.4 Actually, what I wanted was to do the opposite, send all http and https traffic through eth0 and rest through VPN.. After that I did $sudo iptables -L but no rules were displayed. Why so? –  shadyabhi Jan 14 '11 at 14:25
    
iptables -L will only show you the standard table - you want iptables -t nat -L. To do the opposite of what I said, you could do iptables -t nat -A POSTROUTING -s 10.10.98.0/24 ! -d 10.10.98.0/24 -p tcp -m multiport ! --dports 80,443 -j SNAT --to-source 10.100.98.4 –  Andy Smith Jan 14 '11 at 14:43
    
I did what you said but still my traffic from browser goes through VPN. I double checked, I did $iptables -L -t nat ;was showing the rule. What can be the issue? –  shadyabhi Jan 15 '11 at 7:28
    
Apologies - I made a typo in my previous comment - instead of ! --dports 80,443, try --dports 80,443 - i.e., without the ! before --dports. –  Andy Smith Jan 15 '11 at 19:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.