Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to ensure that all traffic to our stats server is forced over the VPN, in the case that the VPN falls down, it shouldn't be that the traffic tries to route over the WAN. To short-circuit the DNS lookups we've listed the host in the hosts file, but it would resolve in the wider world, too.

Here's what we have:

$ echo "12.23.45.67 the.statsd.server" > /etc/hosts

# From a /etc/ppp/ip-up.d/thevpn (so it's a pptp client script that does this)
route add -host 12.34.45.67 dev ppp0

$ iptables -I INPUT -s  12.23.45.67 -i eth0 -j DROP
$ iptables -I OUTPUT -d 12.23.45.67 -o eth0 -j DROP
$ iptables -I OUTPUT -d 12.23.45.67 -o ppp0 -j ACCEPT

Everything up until IP tables works, but the problem (if it is indeed a problem) is that I can now no longer ping that host, even when the VPN is up:

root@li149-82:~# ping the.statsd.server
PING the.statsd.server (12.23.45.67) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

I'm not particularly skilled with IP tables, the key thing is that by default it should not be possible to route to that host, at all unless it's over ppp0.

share|improve this question
add comment

1 Answer

In /etc/hosts you should put the private address of the stats server not the public one. A route should be sufficient. route add -host PRIVATE_ADDRESS dev ppp0 . Whit that configuration the.statsd.server will be resolved only to it's private address and will be routed trhough the ppp0 interface. No need for iptables, because if the vpn is not up, the server will not be accessible by it's private address.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.