1. I have a single linux pc with two nics (eth0 and eth1).
  2. A single isp router connected to the internet. (IP
  3. A single roku3. (hardcoded unchangeable DNS)
  4. A single vpn account (tun0), with all vpn software running on the linux pc.

The linux pc is connected via eth0 (static IP to the isp router, which gives access to the internet. I would like to connect the roku3 directly to the second unused nic (eth1) on the linux pc and have the linux pc route all traffic from the roku3 to the vpn (tun0) on the linux pc. The isp router is the only gateway to the internet.

How would I create a seperate subnet for each nic? I would like to send all traffic that comes from the roku3 into eth1, to the vpn (tun0), and all other traffic originating on the linux pc, regular web browsing, etc, to eth0.

Thanks in advance


It is actually quite easy.

  1. Set up a DHCP service on eth1. You need this because the roku wants an IP address of its own. To do this, choose a subnet that differs from the one you are already using, Any private range will do, something like for instance. You can find all sorts of instructions on how to do this by googling.

  2. Activate IPv4 forwarding,

    echo 1 > /proc/sys/net/ipv4/ip_forward
  3. And MASQUERADE in netfilter,

    iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

That's it.

  • I actually found a simple way to just use a network bridge to share the internet connection of eth0 with eth1: – DMZ Jan 4 '16 at 20:42

I actually found a simple way to just use a network bridge to share the internet connection of eth0 with eth1. Since I already have an account with a vpn provider (IPVanish, they have a tier-1 network), all I had to do was figure out how to share internet between the two ethernet nics.

The steps below, are to share an internet connection and create a network bridge between two ethernet nics, and then connect to the vpn provider. You need two ethernet nics on a single pc, a server.ovpn file, and your vpn provider's username and password for the vpn connection.

Create the bridge.

brctl addbr br0

Bring both interfaces down, as you cannot have an ip address on the nics.

ifconfig eth0 down
ifconfig eth1 down

Add the nics to the bridge.

brctl addif br0 eth0
brctl addif br0 eth1

Bring the nics up without ip address.

ifconfig eth0 up
ifconfig eth1 up

Bring the bridge up

ifconfig br0 up

Give the bridge an ip address of your choosing (example uses

ifconfig br0

Start the client connection to your vpn provider

openvpn --config /path/to/vpn/provider/server.ovpn

You will then be asked for your vpn provider's username and password. The password will not echo, so do not be alarmed when you do not see anything appear. Type correctly and press enter.

Anything connected to eth1 will now be using the internet connection, as well as going through the vpn of eth0. If your isp modem/router has a working dhcp server, anything you connect to eth1 that requests an ip address, such as a roku streaming media player, will automatically be allocated one. Do make sure, that the ip address you give to the br0 is on the same subnet as your dhcp server.

The bulk of the answer I found at this link. I posted it here so that it would be of help to anyone else who has been searching for a simple way to do this on linux.

  • 1
    This is just wrong. Creating a bridge will not change the fact that traffic will go straight out the router bypassing the VPN. All you are doing is creating a 2 port switch out of the Linux box (and having the linux box on a virtual port of the switch). As there is nothing to intercept the traffic at the IP layer, it does not go to the VPN. [ If you are using TAP drivers to have a "flat" network incorporating a VLAN this is a good part of the solution, but thats not what the you (OP) needs - spcifically because you want all traffic through the VPN] – davidgo Jan 4 '16 at 23:21
  • Hello there, I have tested my internet access with www.ipaddress.com to see if my ip address changed into that of the vpn, and it has. Could you explain why the bridge would be the wrong choice? It seems to work. I would appreciate it if you would offer a more correct suggestion on how to do this. Thanks. – DMZ Jan 5 '16 at 5:19
  • 1
    From the Windows box ? If so, did you forget to mention the step of setting your gateway on the Windows box to that of the Linux box - in which case things could work, but you don't need to do any of the steps with bridging to do it. – davidgo Jan 5 '16 at 5:25
  • Ah, thank you. I am using a Linux PC with two Ethernet nics, and my Roku is connected to eth1 of the Linux PC; with eth0 being connected to the ISP modem. The Linux PC has the ISP modem as the default gateway for eth0. And the Roku, works fine; viewing US content without issue. To make sure that the Roku would not use Google DNS: support.ipvanish.com/customer/en/portal/articles/1969109-roku . The Roku has no way of changing any network settings, except for wifi or wired network. And other then the Roku, there are no other devices connected to the LAN; and no Windows PCs in the house. – DMZ Jan 5 '16 at 5:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.