I've been Googling this for days with no success. I connect to a VPN from my server from time to time and I'm trying to configure my Debian server to only use port 80 and 443 through the VPN and all other ports through eth0 interface.

Any help to do this is highly appreciated.


First, see this guide: http://lartc.org/howto/lartc.rpdb.multiple-links.html (and/or other guides for using multiple default routes)

So in your case, I think the solution would be configure two network interfaces (the default eth0 and e.g. eth0:1 with a different valid ip from your lan) for your server, then configure routes so that by default all traffic go to the vpn, and traffic originating from the secondary interface stays off the vpn. Then with ssh bind to the secondary interface with the -b option.

OR set up the multiple routes so that traffic from the secondary interface goes to the vpn, then set up a www proxy server that is bound (only) to the secondary ip address. Then use that proxy server with the browsers.

OR if you use (only) wget, do the above and use the --bind-address option to bind to the secondary interface.

OR a less general solution, as as laurent commented on Dec 20 on the other answer, you can configure an ip specific route for the servers you're connecting to, without fiddling with multiple routing tables. Like this:

route add -host [the host you're connecting to] gateway [your gateway address]

Here's a real world example. I have a vpn connection set up, the vpn address is 23.21.xxx.yyy and my local external address is 91.157.xxx.yyy, and my local internal gateway address is

root@dell64:~# curl -s ipchicken.com|egrep '[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+.*<br>'|sed 's/[0-9][0-9]*[.][0-9][0-9]* .*/xxx.yyy/'
root@dell64:~# route add -host ipchicken.com gateway
root@dell64:~# curl -s ipchicken.com|egrep '[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+.*<br>'|sed 's/[0-9][0-9]*[.][0-9][0-9]* .*/xxx.yyy/'

(ipchicken.com website just displays your external ip address, and the grep filters just the line with the external ip address, and the sed replaces the last parts with xxx.yyy)

  • route is deprecated on linux, you mean ip route add [host connecting to] via [your gateway address] – BatchyX Mar 16 '13 at 20:05
  • Well, route works as well. The above was literally copypasted from my terminal. – Viljo Viitanen Mar 16 '13 at 21:50

If by "use" you mean receiving requests and serving sites, you need to configure Apache (or your webserver) to do that with Listen vpnIP:80 and Listen vpnIP:443. So it won't work on the other IPs.

Additionally using iptables, you can DROP port 80 and 443 for eth0 and only allow on the VPN interface (I used tun0 below) with;

-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j DROP
-A INPUT -i tun0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 443 -j ACCEPT

If by "use" you mean outgoing connection (surfing the web), one way is to install a proxy (like squid) on the server (or somewhere within the VPN) and configure the proxy to send all traffic trhough VPN default gateway. You can use iptables NAT table to redirect port 80 and 443 to the proxy port (3128 for squid) using:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to
iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 80 -j REDIRECT --to-port 3128


tun0 = vpn interface = IP of your server on tun0 (vpn)

And do the same for port 443.

Needs some testing and adjustments probably but this is the general behavior if going this way.

  • thank you for your answer, but I won't be hosting a HTTP server. I just want port 80 and 443 to go through the VPN. For example when using Firefox I want the traffic to go through the VPN. All other ports through eth0. Another option is to exclude some ports going through the VPN. Not sure which one would be easier to create iptable rules for. – Arya Dec 20 '12 at 4:24
  • The problem is that if you block outgoing traffic in iptables, you need to have the router to send it to another route or it won't work. – laurent Dec 20 '12 at 4:30
  • (Pressed enter too early...) A way to do that is to define your default route to the VPN gateway but if you want other things to go to eth0 this won't work too if you need to access external servers on other ports like DNS. I think your best option is to use a proxy on your server and use iptables to redirect port 80 and 443 to the proxy port and configure the proxy to use the VPN. I'll update the answer including iptables redirect to proxy port. – laurent Dec 20 '12 at 4:36
  • how about just preventing port 22 to go through the VPN? is that simple to do? – Arya Dec 20 '12 at 4:46
  • Sure a LOT easier if you use port 22 to ssh to only a few hosts or networks, you can define static routes for them and configure the default route to the vpn. But you will need to know in advance the IPs (or networks) you will ssh to as it is not possible to route based on ports, only IP. – laurent Dec 20 '12 at 4:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.