Is it possible to only route outbound/outgoing traffic through a vpn, while accepting inbound traffic directly, bypassing the vpn connection? I am mostly interested in routing UDP packets.

I've only seen a question regarding linux/unix on the matter, where the use of routing tables comes in handy. I've looked into multiple services and clients, but none seem to offer this feature. Is it simply a very niche feature or just technically not viable on a windows machine?

  • Possible, but not very useful from most points of view. How would a page be served without getting a request, for example? Most transactions on the web require messages going and coming. Perhaps UDP might work? – DrMoishe Pippik May 15 at 1:20
  • I see your point. I failed to mention it was mostly meant for outbound UDP packets. I'll update the question according. – Nikita May 15 at 2:42
  • You probably don't mean "packets" but "connections". The VPN will create a new virtual network adapter and set it as the default route, so this is automatic for outgoing. Incoming connections will come on the physical adapter, so the only problem is to have the program listen on it. I don't think you need to do anything else special for this to work, except ensure that your program listens on the right adapter. – harrymc May 17 at 16:54
  • Indeed the connection is handled by the TAP adapter, which leads me to believe incoming and outgoing UDP traffic cannot be handled differently on a Windows machine, but my networking knowledge is very limited, so figured asking couldnt hurt. – Nikita May 18 at 0:44
  • You misunderstood. Incoming connections using your usual public internet IP will be forwarded to your router and then to the physical adapter. References to your IP on the VPN will be handled by the servers of the VPN provider that will forward to the TAP. The router knows nothing about the VPN, and is certainly not connected to the TAP adapter. So incoming & outgoing connections are handled differently automatically, depending on the IP address they use, on any operating system. – harrymc May 18 at 6:14

VPN works similarly on both Windows and Linux: It creates a virtual TAP network adapter for which it installs a driver. The driver is in constant contact with the servers of the VPN provider and handles outgoing and incoming connections on this virtual adapter. It will by default add a default rule to the routing table on your computer, which will make all outgoing connections pass by default through the VPN.

The VPN provider functions very similar to your ISP: It owns a range of IP addresses from which it allocates one address for your computer. All connections employing this IP address pass through the VPN provider.

This means that your computer now has two IP addresses, one through your ISP and one through the VPN provider.

Any incoming connection to the VPN IP address will arrive through the virtual TAP network adapter (requires the caller to use correctly a compatible VPN client). Any incoming connection to the ISP IP address will arrive at your router which will pass on the connection to the physical adapter. The router knows nothing about a VPN that is created on your computer (unless the router itself is the one that connects to the VPN).

This means that by default the situation is exactly as you want: Outgoing connections will by default pass through the VPN's TAP adapter, while incoming connections using your public address will end up on the physical adapter.

The only problem is then enabling your specific program to listen on the physical adapter for incoming connections. This can be achieved by two possible methods:

  • Start this program before starting the VPN client may work (or not)
  • Bind this program to the physical interface. If you are not its developer, you could try the free ForceBindIP, a freeware Windows application that injects itself into another application and alters how certain Windows socket calls are made, allowing you to force the application to use a specific network interface / IP address.
    See also the article 3 ForceBindIP GUI to Easily Bind Windows Application to Specific Network Adapter.

The viability of this solution depends a lot on your hardware (chiefly the router) and the software (VPN driver and operating system).

| improve this answer | |
  • Thank you very much for the elaborate explanation. ForceBindIP seems to merely handle assigning the adapter to an application, and indeed injecting its handle by targeting winsock. This functionality is readily available in apps such as ProtonVPN, which they call "Split Tunneling". Besides having an application inject code isn't viable for many guarded applications, e.g. games (anticheats and such). As for the TAP adapter, incoming connections would still suffer from the latency induced by the vpn, which wouldn't be the case if the incoming traffic bypassed it completely. – Nikita May 18 at 21:09
  • Incoming connections through the ISP IP will not go through the VPN, with no added latency. – harrymc May 19 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.