How can I use one network port for VPN and the other for everything else?

Question

My Linux machine has two network ports with two IP addresses. I want to use one port for my VPN and accounting, and the other port for other usages. How can I tell Linux not to allow any requests from port 2 for Apache, MySQL, mailserver, ssh, etc. so it will use the VPN port, and likewise not allow port 1 to handle VPN traffic but allow everything else?

Answer 1

The ip(8) command can configure your interfaces and routing tables to do exactly as you desire. The Linux Advanced Routing And Traffic Control guide has the best description of how to use the ip(8) tool that I've yet found.

You need to make sure your routing tables know which interface is to be used for which IP ranges. Once you've defined that, typing it in is nearly a mechanical translation.

Answer 2

use a firewall (iptables for example), and configure your firewall to drop any vpn packet on the first interface.

don't forget to configure the route on your vpn software so that it uses the second interface. (the firewall will block the packets but will not tell the vpn software to retry on the other interface).