103

I have access to a VPN and want to use it only for some applications, not all.

For example:
If I connect to a VPN I want only the applications Opera and Newsbin to use that VPN connection. All other applications, like f.e. Outlook, should use the normal internet connection (while the VPN is connected/open).

Afaik this isn't possible, but I'm not totally sure. So therefore my question: is it doable?

2
  • 4
    related: Disable VPN for a given process/application
    – slhck
    Jun 7, 2011 at 12:54
  • The question is a challenge to the VPN specifications it looks. There should be user-control over network flow, which is, based on the answers given below, not the case.
    – user486359
    Aug 25, 2023 at 7:47

12 Answers 12

-9

No it isn't. Well not using normal means. Routing is routing. Routing operates lower down the OSI model. What you need to happen is for it to be aware at the applicaion level (higher up) so it can detect what program you are using etc. NORMAL routers do not allow you to configure routes based on applications or port numbers.

I think it is possible though. Routers can see ports so you can filter them by port number and send the traffic out different routes. i am sure i read something a while ago with Cisco routers that can do this. They don't come cheap though and they are business routers which require a lot of config and I'm guessing you want something simple for home use.

In summary it is the router that would need this feature and your bog standard ones for home use, even business don't support these features. Only the advanced line of Cisco and Sonicwalls offer these capabilities.

5
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – DavidPostill
    Jun 30, 2021 at 7:08
  • This is just plain wrong. The accepted answer should be changed.
    – scob
    Dec 3, 2022 at 8:04
  • how is it wrong scob? You might want to check the convo I had with Davidpostill above first lol. If the OP doesn't know how to ask the correct question, then you can only answer it as best you can with the information provided. As I stated above, and will again, you cannot do this with a normal router. There are ways around it (which I also said), using special hardware of software, but everything I said is a factually correct
    – Mucker
    Dec 6, 2022 at 0:00
  • It's a shame people on the Internet are so clueless also, that they will downvote an answer just because it's not what they want to hear. Take the answer two below here, the windows firewall one. It is completely wrong and does not achieve the desired out come of the OP. It BLOCKS the connections, but the OP did not want this, he wanted them to go out the internet and not VPN, not block it entirely. This is obvious to me that it is the wrong answer. But its been upvoted so many times. This demonstrates that people don't even read the posts and answers properly.
    – Mucker
    Dec 6, 2022 at 0:14
  • Also, for anyone thinking of downvoting, here is proof I am correct. Another post (marked as the correct answer no mind!) says the same thing as me but he has gone into more detail to explain how the tech works. I did explai this myself, I just did not go into as much detail as this guy. please upvote this as it is actually correct... superuser.com/questions/983727/…
    – Mucker
    Dec 6, 2022 at 0:24
67

It is possible to accomplish this, at least on Linux (and I'm thinking on BSD and OS X as well). You can do so by:

  • Create an exra user for all VPN traffic.
  • Create an extra routing table with 1 default route via the VPN.
  • Configure Netfilter through Iptables to use the other routing table for all traffic originating from a specific User ID.
  • Run the applications that should use the VPN under their own user. For example with 'sudo'.

There are scripts for accomplishing the above steps here or there is another guide here.

Here is a detailed guide for routing Transmission via a VPN (using a VPN server that you own.

3
  • 5
    Much easier on Linux: Create a network namespace, connect VPN to that namespace, run applications that should use the namespace in the VPN. You can even run two copies of the same application, one using the VPN and one using the direct connection.
    – dirkt
    Sep 12, 2019 at 14:53
  • @dirkt I don't know if it is the best solution but it works great as a SOCKS proxy by using an SSH tunnel to an LXC container connected to an OpenVPN server: askubuntu.com/questions/703905/… Related: superuser.com/questions/263360/openvpn-client-as-socks-5-server
    – baptx
    Jan 30, 2020 at 21:48
  • 4
    I appreciate this answer, but the question was about Windows.
    – andre_ss6
    Oct 8, 2021 at 1:51
21

You could use the Windows Firewall to accomplish this (provided you are using Win 7 or Vista) - I wrote a guide on this

  1. Connect to your VPN as you normally would.

  2. Open the Network and Sharing Center - right-click on the Internet connection icon in the taskbar and choose "Open Network and Sharing Center" (see below)

  3. You should see (at least) two networks listed under "View Your Active Networks" - your VPN connection and one called "Network" - a.k.a. your ISP Connection. Ensure that your VPN is a "Public Network", and your ISP connection is "Home Network". If you need to change either connection, click it and an option window will appear (see below).

  4. Go to the Control Panel and click System and Security (see below).

  5. In the resulting window, click Windows Firewall (see below).

  6. In the Windows Firewall window, click Advanced Settings on the left pane (see below). Note: You must be logged in as an Adminstrator to make changes to the Firewall Settings.

  7. You should see a window titled Windows Firewall with Advanced Security. In this window, click Inbound Rules (see below).

  8. On the right pane, you will see an option for a New Rule. Click it (see below).

  9. In the New Inbound Rule Wizard (which should appear), do the following:

    • Choose Program and click Next.

    • Choose the program you wish to block all traffic to except on the VPN connection, and click next.

    • Choose Block the Connection.

    • Tick Domain and Private. Make sure Public is left unticked.

  10. Repeat Step 9 for Outbound Rules.

6
  • 20
    Does this actually answer the question? Yes, this stops the app from working if it isn't on the VPN, but all traffic still goes over the VPN does it not? Apr 20, 2015 at 20:33
  • 3
    @pramble So does all traffic still go through the vpn?
    – nsij22
    May 8, 2015 at 21:47
  • Appears to work. Just tested it..
    – Faiz
    Dec 11, 2017 at 7:08
  • 1
    This doesn't fix it. This is a very simple scenario. I want all my work-related stuff to go over the VPN (SQL Server connections, Slack, etc.), but I want my web browser (Facebook, Soundcloud, etc., basically all port 80 traffic) to NOT go over the VPN. Windows sucks if this isn't possible.
    – Triynko
    Jan 8, 2018 at 19:09
  • 5
    Yeah this answer is opposite to what was asked by OP. I need to allow only a specific application to use a VPN network.
    – Nakilon
    Feb 9, 2020 at 10:34
17

You can do it with network namespaces on GNU/Linux.

Here's how to run OpenVPN and a single application in a separate namespace:

Create the net network namespace:

ip netns add myvpn

Start the loopback interface in the namespace (otherwise many things don't work as expected…)

ip netns exec myvpn ip addr add 127.0.0.1/8 dev lo
ip netns exec myvpn ip link set lo up

Create virtual network interfaces that will let OpenVPN (in the namespace) access the real network, and configure the interface in the namespace (vpn1) to use the interface out of the namespace (vpn0) as its default gateway

ip link add vpn0 type veth peer name vpn1
ip link set vpn0 up
ip link set vpn1 netns myvpn up
ip addr add 10.200.200.1/24 dev vpn0
ip netns exec myvpn ip addr add 10.200.200.2/24 dev vpn1
ip netns exec myvpn ip route add default via 10.200.200.1 dev vpn1

Enable IPv4 routing and NAT for the interface in the namespace. As my default interface is a wireless one, I use wl+ (which may match wlan0, wlp3s0, etc.) in iptables for the outgoing interface; if you use a wired interface you should probably use en+ (or br+ for a bridged interface)

iptables -A INPUT \! -i vpn0 -s 10.200.200.0/24 -j DROP
iptables -t nat -A POSTROUTING -s 10.200.200.0/24 -o wl+ -j MASQUERADE
sysctl -q net.ipv4.ip_forward=1

Configure the nameserver to use inside the namespace

mkdir -p /etc/netns/myvpn
echo 'nameserver 8.8.8.8' > /etc/netns/myvpn/resolv.conf

Almost done, now we should have full network access in the namespace

ip netns exec myvpn ping www.google.com

Finally start OpenVPN in the namespace

ip netns exec myvpn openvpn --config /etc/openvpn/myvpn.conf

Once tun0 is up in the namespace, you're ready to start the program you wanted!

while ! ip netns exec myvpn ip a show dev tun0 up; do sleep .5; done
ip netns exec myvpn sudo -u $MYSELF popcorntime

SOURCE article.

Also there is a wrapper script in the source article you can adapt for your needs.

12

I've done this on Windows. The idea is to bind the outgoing network packages to VPN's interface. People suggest ForceBindIP for this, but thanks to this answer I've got an idea to use proxy. The downside of this method is that either your apps have to have proxy support or you'll have to use a proxifier (see here and here). The upside is that this way you'll be able to limit the use of VPN in the browser to specific domains using FoxyProxy or similar add-ons.

I use 3proxy in SOCKS mode and bind its external interface to VPN's IP. OpenVPN is used for the VPN connection.

In my .ovpn file (client, dev tun) I've added these lines:

route-nopull
route 0.0.0.0 0.0.0.0 vpn_gateway
pull-filter ignore "dhcp-option DNS "
script-security 2
up 'c:\path\to\up.cmd'
down 'c:\path\to\down.cmd'

route-nopull to ignore routes pushed from the server. In your case you might need to comment out redirect-gateway instead.

route to add a route for this interface, without this line it won't be used even if the app is bound to it.

pull-filter to preserve pushed DNS that otherwise will be dropped by route-nopull together with the pushed routes. This option is supported starting with OpenVPN 2.4, if you have to stick with OpenVPN 2.3 (latest release for Windows XP), you'll have to add two dhcp-option DNS x.x.x.x lines with hardcoded IPs instead.

script-security 2 to allow scripting.

up script:

cd %~dp0
echo auth none> 3proxy-openvpn.conf
echo internal 127.0.0.1>> 3proxy-openvpn.conf
echo external %4>> 3proxy-openvpn.conf
echo socks>> 3proxy-openvpn.conf
start /b 3proxy.exe 3proxy-openvpn.conf

down script:

taskkill /f /im 3proxy.exe

Thus, after you connect to VPN using this config, 3proxy.exe process will be started and a localhost-limited SOCKS5 proxy with DNS resolution capability will run on the 1080 port, now just configure your app to use localhost:1080 SOCKS proxy.

3
  • I am getting Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS]) and Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]). None the less, this solution works. If you skip the apostrophes for down and up script, use double backslashes: c:\\path\\to\\script
    – chx
    Jan 16, 2018 at 14:42
  • I can't get this to work, 3proxy returns a 94 code, which is described as "connection termination by server or client with unsent data". Firefox returns a "PR_END_OF_FILE_ERROR" and Chrome "ERR_EMPTY_RESPONSE". I also tried a HTTP proxy instead of SOCKS, with the same result.
    – sp00n
    Apr 13, 2023 at 23:22
  • Latest update on ForceBindIP is 2017, this still works? Looks hacky.
    – user486359
    Aug 25, 2023 at 7:43
7

Just access the VPN through a virtual machine.

  1. Create a VM, then from inside the VM...
  2. Install the 'selected' applications
  3. Configure the VPN

Use the 'selected' applications from the VM instead of using them from the host machine.

P.S. You need to give network access to the VM through the host machine, of course.

6
  • This just mentions an approach already described in detail in other answers.
    – fixer1234
    Jan 16, 2018 at 3:46
  • 5
    @fixer1234: Nobody mentioned virtual machines.
    – drowa
    Jan 16, 2018 at 3:49
  • Can you expand your answer into something more actionable (explain the how)? See the other answers on the thread for an idea of the level of detail. Just providing a hint for a direction to pursue would go in a comment, which requires a little more rep.
    – fixer1234
    Jan 16, 2018 at 4:05
  • I've tried a comment first but the system didn't allow me because I have less than 50 points. I will try to expand the answer then.
    – drowa
    Jan 16, 2018 at 4:08
  • This is the idea I came up with, and it works fine, without any complicated routing configuration on the sysadmin side.
    – pwned
    Aug 26, 2019 at 8:03
6

On Windows you can use a vpn that supports "Split Tunnelling".

One is Proton VPN (Free version available, allows you to select which apps you want or don't want to access the vpn).

Otherwise just google: vpn with split tunnelling and many will appear.

2
  • Valid answer, supported by some VPN clients only, specifically relevant because you may want to route video traffic etc. differently. The fact that we are in this forum looking for answers tells you that there is a lack of user-friendliness of VPN clients which also make this topic a priority, namely to allow users to control their traffic.
    – user486359
    Aug 25, 2023 at 8:09
  • Good answer, but Proton doesn't currently support split tunneling in the free tier anymore.
    – Minding
    Jan 18 at 1:14
5

If you're on linux, and you use openVPN, VPNShift works beautifully.

1
  • 12
    Is the fact that it's "the same answer to multiple questions" so important? The question exists, it's not (yet) flagged as duplicate, and it's a good answer, so it deserves to exist. Thanks @thouliha 🙂. Oct 19, 2018 at 12:34
5

There's now an easier solution for linux that wasn't around at the time that many of these answers were written, but it's definitely worth putting here. It's a program called Vopono.

It works by creating temporary network namespaces on your PC for a specific command to run through. Once the program finishes running, it will get rid of the namespace.

It directly supports VPNs such as Mullvad, AzireVPN, MozillaVPN, TigerVPN, ProtonVPN, iVPN, NordVPN, and PIA, but can also support custom configuration files for Wireguard, OpenVPN, OpenConnect and OpenFortiVPN protocols.

Example usage with custom config file:

vopono exec --custom vpn_config.ovpn --protocol openvpn "command"

More detailed usage info can be found here.

1
  • Nice suggestion (Vopono), but multiple unsupported corporate VPNs exist, sadly.
    – user486359
    Aug 25, 2023 at 7:45
0

I know this is a way late reply that I just ran across, but in case it's ever relevant to someone, I had the same circumstance where I wanted to run my work traffic through the VPN but didn't want my personal traffic routed through their proxy servers and such. So I was running Win7 back then but they were still running WinXP on a lot of their systems. Eventually they just gave me a 2nd PC to run for work which resolved the issue (a switchbox hooked to both PCs, could just jump back and forth) but prior to this I ran a Virtual XP that I set up as my work OS... I would VPN in from said VM to connect to work, which would leave my personal OS traffic free of the work restrictions and spying.

0

Though it is late reply, I think it still makes sense to leave it here. And yes, it is doable on Windows but only if you have a VPN client supporting this. Recently I have implemented one for the Wireguard VPN on top on NDIS filter driver and BoringTun WireGuard implementation in Rust. You can get it from https://www.wiresock.net/wiresock-vpn-client/

0

For the record, stumbled across this app that proposes a solution to the situation: https://github.com/TunnlTo/desktop-app

(No recommendation, not tested, etc. just fyi)

You must log in to answer this question.