Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My setup is the following: I have an ssh access to a distant machine, running the last version of Ubuntu Server edition, and I have to run a software on it "through" HideMyAss VPN (because this machine's IP has to be spoofed when the software is running). But of course I want to be able to still access the machine via it's "original" IP.

My problem is that as soon as I start the hma-start script on the distant machine (which basically gets a configuration file from their servers, and run openvpn with it), I loose the connection and I can't connect to it anymore.

Is that solvable at all and if so how? Thanks!

share|improve this question

migrated from Aug 19 '12 at 18:20

This question came from our site for professional and enthusiast programmers.

up vote 3 down vote accepted

If you only want your specific software to use the VPN connection, then you may use network namespaces.

basically, the command ip netns add vpn will create another namespace for network devices, routing tables, firewall rules and so on, so it's like running two network stacks.

A network device can only be in one namespace, so you will need a virtual device, acting as a bridge between your two namespaces.

That's exactly what virtual network interfaces are for:

ip link add veth0 type veth peer name veth1

everything that goes in veth0 will go out of veth1, and so on. Now you only need to move one of the virtual interfaces to the other network namespace :

ip link set veth0 netns vpn

Now you have a situation similar to this network topology :

                   .----------.              .------.
[intertubes] ------|   Host   |--------------|  vpn |
               eth0`----------`veth1    veth0`------`

You can apply whatever method you want to share the internet connection. Either do masquerading (if the vpn supports traversing NAT), routing/bridging (you will need another IP address or serious configurations) or whatever method you like.

When you want to 'access' vpn, run ip netns exec vpn bash and you will end up in the vpn namespace. You will see that this namespace only have the veth0 network interface, as well as an unconfigured lo interface that you may want to configure using ip addr add dev lo && ip link set lo up. Now just configure your veth0 interface so you can connect to the internet, then launch your VPN so it can reconfigure the network to go through the VPN. You will see that the main namespace will not use the VPN, while the vpn namespace will.

share|improve this answer
Genius! From the point of view of a newbie in networking anyway. You have made a couple of typos though: ip link add veth0 type veth peer name veth1 and ip netns exec vpn bash The internet sharing was a bit less than obvious, but in the end it all worked. Thanks a lot! – m4573r Aug 23 '12 at 15:14
Fixed the typos. – BatchyX Aug 23 '12 at 20:42
@m4573r is there a detailed explanation for that how to apply this solution for a newbie ? – motto Feb 17 '13 at 13:15
@motto Well, it's just a set of commands that you have to type with elevated rights... and I really wouldn't know how to explain it better than BatchyX. It took me a bit of time understanding everything myself, but it's as good as a tutorial imho. Just try to type the commands and follow the solution. – m4573r Feb 18 '13 at 13:13
@m4573r ip netns isn't working on ubuntu 10.04 hmmm – motto Feb 18 '13 at 13:28

The connection breaks because the VPN will change the default route so everything goes into the VPN. You may change that routing table, but it can be tricky to get right, especially if you lose ssh access if things go wrong.

One easy simple solution is to tell your server to reach your own IP address via eth0 by setting a route :

    ip route add your_ip_address via the_server's_gateway

and hoping that the VPN script won't touch it.

If you also want to allow other hosts to access the server's original address, that is to say, if you also want your server to both answer his original IP address and the VPN's IP address, you will need to alter how the VPN changes your route, or at least know how it changes them to workaround what it does.

Basically, what you want is policy routing. You will have two routing table: one will use the VPN, and the other will not use it.

If the VPN script will only modify the main table, then you can add another routing table to be used for the original IP address.

So basically, before launching the VPN, you duplicate the main's content into another table, for example table 2 (2 is an arbitrary number here, see /etc/iproute2/rt_tables to define a name alias):

ip route add (network)/(prefixlen) dev eth0 src (address) table 2
ip route add default via (gateway) dev eth0 src (address) table 2

Now add a rule to use that table if your server is accessed by its original IP address from the eth0 interface:

ip rule add to (address) iif eth0 table 2

Then you launch your VPN script.

In theory, you should run ip rule add before adding the default route to your second table because otherwise, the kernel will reject this rule, saying that it can't route to the gateway. but in your case it will just work fine as main can already route to the gateway.

share|improve this answer
For some reasons this solution didn't work (in the sense that the machine on which I run the vpn script was unreachable using it's "normal" ip address)... – m4573r Aug 23 '12 at 15:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.