Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to ensure that all traffic to our stats server is forced over the VPN, in the case that the VPN falls down, it shouldn't be that the traffic tries to route over the WAN. To short-circuit the DNS lookups we've listed the host in the hosts file, but it would resolve in the wider world, too.

Here's what we have:

$ echo " the.statsd.server" > /etc/hosts

# From a /etc/ppp/ip-up.d/thevpn (so it's a pptp client script that does this)
route add -host dev ppp0

$ iptables -I INPUT -s -i eth0 -j DROP
$ iptables -I OUTPUT -d -o eth0 -j DROP
$ iptables -I OUTPUT -d -o ppp0 -j ACCEPT

Everything up until IP tables works, but the problem (if it is indeed a problem) is that I can now no longer ping that host, even when the VPN is up:

root@li149-82:~# ping the.statsd.server
PING the.statsd.server ( 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

I'm not particularly skilled with IP tables, the key thing is that by default it should not be possible to route to that host, at all unless it's over ppp0.

share|improve this question

In /etc/hosts you should put the private address of the stats server not the public one. A route should be sufficient. route add -host PRIVATE_ADDRESS dev ppp0 . Whit that configuration the.statsd.server will be resolved only to it's private address and will be routed trhough the ppp0 interface. No need for iptables, because if the vpn is not up, the server will not be accessible by it's private address.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .