sometimes I need to connect to websites without passing through VPN, is it possible to open an instance of Firefox and tell it to use the plain eth0 interface instead of the tun0 ?


You can add routes for any websites you want to pass via eth0 like this:

ip route add websiteIP via gatewayIP dev eth0

Here, you add the IP address of the website you want to visit at websiteIP, and add your normal gateway IP at gatewayIP.

  • what is gateway IP ? – ChiseledAbs Jul 17 '16 at 14:08
  • It is the IP address of your normal router. You can see it with ip route show command as the default gateway when you are not connected to VPN. – Tero Kilkanen Jul 17 '16 at 20:51

I did something similar with iptables a while back. The main difference between your goal, and my project, was that I was attempting to redirect all traffic incoming from the network to tun0. No changes to firefox required. The gist of it is this:

  1. A custom entry in rt_tables is created to handle certain packets
  2. All packets destined for port 80 or a specific IP are given a mark
  3. All packets matching the mark in step 2 get passed to the rt_table specified in step 1.
  4. The packets in the new rt_tables needs to have a different gateway than the rest - the IP of eth0

I found some old code of mine that should work for you either as it is, or with minor modifications. This is a slightly modified set of the code that I used to run on my gateway:

# Create the new custom router table
echo 201 CustomRouter >> /etc/iproute2/rt_tables

# Mark the desired packets for special treatment
iptables -t mangle -A PREROUTING -d -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -d -j MARK --set-mark 2

# Assign marked packets to CustomRouter
ip rule add fwmark 2 table CustomRouter

# Set the gateway
ip route add default via dev eth0 table ClientRouter

The above presumes that is the IP of the website you want via eth0, and is the IP of eth0. Modify the two lines with that IP to match whatever you want, be it everything on port 80, or just specific one IP. the is just a bogus IP I used for testing this.

Note that the line that creates CustomRouter in rt_tables doesn't have to be executed every time. The perl scrip from which I extracted this has a check to see if it's already there, so I believe it may only have to be done once, or possibly once every boot.


network rules with ip route and iptables cannot use the program name as a criteria

If you need to route traffic to the other interface only for firefox and not for any request to a port 80, you could use network namespaces on newest kernels. They limit which system resources are available for a process ("ip netns")

Here is an introduction with a similar example:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.