Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Goal State: Have the traffic from one computer on my LAN use the VPN tunnel setup between my router and an OpenVPN provider, and leave all other traffic unaffected.

Here's some relevant information about my router:

  • Model: Netgear WNDR3400
  • FCC ID: PY309300116
  • Firmware: DD-WRT v24-sp2 (12/08/11) mega, build 17990M
  • At the router prompt (via ssh),
root@hermes# nvram show | grep bytes
size: 33129 bytes (32407 left)

The DD-WRT router (hermes is configured as an OpenVPN client, and it successfully connects to the OpenVPN server (torchwood

I tested this by running tail -f /var/log/openvpn.log on torchwood, and running ping on hermes, as well as verifying the contents of /tmp/var/log/openvpn.log on hermes - I can definitely see torchwood gets the ping traffic from hermes.

What I'm trying to do is use simple source policy routing so another computer (solomon on my LAN will have all its traffic routed through the VPN connection. However, my attempts to setup the table as in the example have not been successful.

Here's the steps I take:

  1. Using the router's web UI, I place the following as a firewall script:
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source -j ACCEPT
iptables -I FORWARD -i br0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT
  1. I save the firewall script, and reboot the router.
  2. On a separate computer (lars) I ssh into hermes.
  3. On hermes I run the following commands:
root@hermes# mkdir /tmp/etc/iproute2
root@hermes# echo "200 ovpn" >> /tmp/etc/iproute2/rt_tables
root@hermes# ip rule add from all lookup ovpn
root@hermes# ip route add default via dev tun1 table ovpn
root@hermes# ip route flush cache

The end result is that the iproute2 folder is created, and 200 ovpn is the contents of the rt_tables file in that folder. However, when I run:

root@hermes# ip rule list
0:  from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default 
root@hermes# ip route show table ovpn
root@hermes# ip route show table all dev tun1  src 
X.Y.Z.1 dev vlan2 via dev tun1 via dev tun1 dev br0  src 
X.Y.Z.0/21 dev vlan2  src X.Y.Z.W dev br0  src dev lo 
default via X.Y.Z.1 dev vlan2 
broadcast dev lo  src 
broadcast X.Y.Z.0 dev vlan2  src X.Y.Z.W
local dev br0  src 
local dev tun1  src 
broadcast X.Y.Z.255 dev vlan2  src X.Y.Z.W
broadcast dev br0  src 
broadcast dev br0  src 
broadcast dev br0  src 
local X.Y.Z.W dev vlan2  src X.Y.Z.W
broadcast dev lo  src 
broadcast dev br0  src 
local dev lo  src 
local dev br0  src 
local dev lo  src 
root@hermes# ifconfig tun1
tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:  P-t-P:  Mask:
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:252 (252.0 B)  TX bytes:252 (252.0 B)

Neither command outputs the information I just added. I've also tried adding the commands to the startup script in the router web UI, and to /tmp/openvpn/ with no results.

  • What's the right way to do this so that the configuration persists?
  • Is the firewall script strictly necessary?
  • Will this setup achieve the goal of getting solomon out through the VPN and leaving all other traffic unaffected?

Also: is there an alternative? For example, perhaps if I skip the VPN setup on the router, and instead establish the OpenVPN link from solomon directly to torchwood, then I have to only change the routing table on solomon?

share|improve this question

migrated from Nov 29 '12 at 18:24

This question came from our site for system and network administrators.

That doesn't sound like a crash. That sounds like a broken configuration that caused network connectivity to be lost. – David Schwartz Nov 29 '12 at 0:09
How precisely does it fail? – David Schwartz Nov 29 '12 at 0:25
You're still giving vague descriptions like "can't connect". Well why can't you connect? What happens when you try? For example, Wired: Does the port light up? Do you get assigned an IP address? Do you get assigned a default gateway? Can you ping it? Wireless: Do you see the network in the list of networks? When you double-click on it, do you get prompted for the key? Then what happens? – David Schwartz Nov 29 '12 at 0:56
Did you ever figure this out? I am struggling with the almost identical problem. I have the added problem that when I enter "ip rule list" on my DD-WRT routed, I get no output at all. – LostInTheTrees Dec 31 '15 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.