Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a home LAN behind a Linux firewall connected to the Internet. The firewall also has a VPN connection to a remote host that can route traffic from the VPN to its Internet connection with NAT.

I want to configure the firewall to route the default (i.e. non-local) traffic of a specific host on the home LAN to the VPN rather than the Internet connection of the firewall which is shared by all other local hosts. This is to work around country-IP based filtering forced by network service sites where the remote VPN host is installed.

share|improve this question

migrated from Jul 18 '12 at 19:18

This question came from our site for system and network administrators.


  • IPRoute2

What you want is made possible by the above package. This is typically referred to as policy-based routing, and in your specific case source policy routing.

You'll need to complete the following:

  • Check which routing table numbers are used: cat /etc/iproute2/rt_tables
  • Create a routing table which includes the machine in question
  • Add the default route for the specific table
  • Flush the route cache

I don't have a Linux terminal handy; but it should be something like this:

echo ### tableName >> /etc/iproute2/rt_tables ## pick a number not in use

ip rule add from table tableName

ip route add dev tun0 table tableName ##assuming tun0 is your VPN

ip route flush cache

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.