sometimes I need to connect to websites without passing through VPN, is it possible to open an instance of Firefox and tell it to use the plain
eth0 interface instead of the tun0 ?
I did something similar with iptables a while back. The main difference between your goal, and my project, was that I was attempting to redirect all traffic incoming from the network to tun0. No changes to firefox required. The gist of it is this:
- A custom entry in
rt_tablesis created to handle certain packets
- All packets destined for port 80 or a specific IP are given a mark
- All packets matching the mark in step 2 get passed to the rt_table specified in step 1.
- The packets in the new
rt_tablesneeds to have a different gateway than the rest - the IP of eth0
I found some old code of mine that should work for you either as it is, or with minor modifications. This is a slightly modified set of the code that I used to run on my gateway:
# Create the new custom router table echo 201 CustomRouter >> /etc/iproute2/rt_tables # Mark the desired packets for special treatment iptables -t mangle -A PREROUTING -d 22.214.171.124 -j MARK --set-mark 2 iptables -t mangle -A OUTPUT -d 126.96.36.199 -j MARK --set-mark 2 # Assign marked packets to CustomRouter ip rule add fwmark 2 table CustomRouter # Set the gateway ip route add default via 192.168.0.123 dev eth0 table ClientRouter
The above presumes that
188.8.131.52 is the IP of the website you want via eth0, and
192.168.0.123 is the IP of
eth0. Modify the two lines with that IP to match whatever you want, be it everything on port 80, or just specific one IP. the
184.108.40.206 is just a bogus IP I used for testing this.
Note that the line that creates
rt_tables doesn't have to be executed every time. The perl scrip from which I extracted this has a check to see if it's already there, so I believe it may only have to be done once, or possibly once every boot.
network rules with ip route and iptables cannot use the program name as a criteria
If you need to route traffic to the other interface only for firefox and not for any request to a port 80, you could use network namespaces on newest kernels. They limit which system resources are available for a process ("ip netns")
Here is an introduction with a similar example: