Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Goal State: Have the traffic from one computer on my LAN use the VPN tunnel setup between my router and an OpenVPN provider, and leave all other traffic unaffected.

Here's some relevant information about my router:

  • Model: Netgear WNDR3400
  • FCC ID: PY309300116
  • Firmware: DD-WRT v24-sp2 (12/08/11) mega, build 17990M
  • At the router prompt (via ssh),
root@hermes# nvram show | grep bytes
size: 33129 bytes (32407 left)

The DD-WRT router (hermes 10.1.1.1) is configured as an OpenVPN client, and it successfully connects to the OpenVPN server (torchwood 10.8.0.1).

I tested this by running tail -f /var/log/openvpn.log on torchwood, and running ping 10.8.0.1 on hermes, as well as verifying the contents of /tmp/var/log/openvpn.log on hermes - I can definitely see torchwood gets the ping traffic from hermes.

What I'm trying to do is use simple source policy routing so another computer (solomon 10.1.1.20) on my LAN will have all its traffic routed through the VPN connection. However, my attempts to setup the table as in the example have not been successful.

Here's the steps I take:

  1. Using the router's web UI, I place the following as a firewall script:
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT
  1. I save the firewall script, and reboot the router.
  2. On a separate computer (lars) I ssh into hermes.
  3. On hermes I run the following commands:
root@hermes# mkdir /tmp/etc/iproute2
root@hermes# echo "200 ovpn" >> /tmp/etc/iproute2/rt_tables
root@hermes# ip rule add from all 10.1.1.20 lookup ovpn
root@hermes# ip route add default via 10.8.0.1 dev tun1 table ovpn
root@hermes# ip route flush cache

The end result is that the iproute2 folder is created, and 200 ovpn is the contents of the rt_tables file in that folder. However, when I run:

root@hermes# ip rule list
0:  from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default 
root@hermes# ip route show table ovpn
root@hermes# ip route show table all
10.8.0.5 dev tun1  src 10.8.0.6 
X.Y.Z.1 dev vlan2 
10.8.0.0/24 via 10.8.0.5 dev tun1 
10.1.10.0/24 via 10.8.0.5 dev tun1 
10.1.1.0/24 dev br0  src 10.1.1.1 
X.Y.Z.0/21 dev vlan2  src X.Y.Z.W 
169.254.0.0/16 dev br0  src 169.254.255.1 
127.0.0.0/8 dev lo 
default via X.Y.Z.1 dev vlan2 
broadcast 127.255.255.255 dev lo  src 127.0.0.1 
broadcast X.Y.Z.0 dev vlan2  src X.Y.Z.W
local 169.254.255.1 dev br0  src 169.254.255.1 
local 10.8.0.6 dev tun1  src 10.8.0.6 
broadcast X.Y.Z.255 dev vlan2  src X.Y.Z.W
broadcast 169.254.0.0 dev br0  src 169.254.255.1 
broadcast 10.1.1.255 dev br0  src 10.1.1.1 
broadcast 169.254.255.255 dev br0  src 169.254.255.1 
local X.Y.Z.W dev vlan2  src X.Y.Z.W
broadcast 127.0.0.0 dev lo  src 127.0.0.1 
broadcast 10.1.1.0 dev br0  src 10.1.1.1 
local 127.0.0.1 dev lo  src 127.0.0.1 
local 10.1.1.1 dev br0  src 10.1.1.1 
local 127.0.0.0/8 dev lo  src 127.0.0.1 
root@hermes# ifconfig tun1
tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:252 (252.0 B)  TX bytes:252 (252.0 B)

Neither command outputs the information I just added. I've also tried adding the commands to the startup script in the router web UI, and to /tmp/openvpn/route-up.sh with no results.

  • What's the right way to do this so that the configuration persists?
  • Is the firewall script strictly necessary?
  • Will this setup achieve the goal of getting solomon out through the VPN and leaving all other traffic unaffected?

Also: is there an alternative? For example, perhaps if I skip the VPN setup on the router, and instead establish the OpenVPN link from solomon directly to torchwood, then I have to only change the routing table on solomon?

share|improve this question

migrated from serverfault.com Nov 29 '12 at 18:24

This question came from our site for professional system and network administrators.

    
That doesn't sound like a crash. That sounds like a broken configuration that caused network connectivity to be lost. –  David Schwartz Nov 29 '12 at 0:09
    
How precisely does it fail? –  David Schwartz Nov 29 '12 at 0:25
    
You're still giving vague descriptions like "can't connect". Well why can't you connect? What happens when you try? For example, Wired: Does the port light up? Do you get assigned an IP address? Do you get assigned a default gateway? Can you ping it? Wireless: Do you see the network in the list of networks? When you double-click on it, do you get prompted for the key? Then what happens? –  David Schwartz Nov 29 '12 at 0:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.