Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to set up a couple of VPN connections to two different countries, A and B, on my Ubuntu Server. Then I would like to set up rules based on GeoIP to determine which VPN connection should be used when I surf the internet. If the website I browse is in country A then I should use VPN connection A, if it is in country B then I should use connection B, and if it is in neither A nor B then I shouldn't use either of the VPN connections (default should be my DSL connection).

Is this possible to set up?

share|improve this question

I don't know of an "out-of-the-box" solution that does this completely automatically and seamlessly. It is possible. The best I can do is provide a "high-level" summary.

Basically, you are looking at a routing problem. You want traffic destined to specific subnets to travel over different gateway IP addresses. If you are willing to live without a dynamic solution, you can do the following:

  • Find out what subnets represent the traffic in "different countries" and which VPN you want them to use. Let's, for example, say that anything in is in a different country and you do NOT want it leaving except via a VPN. You have your modem connected to eth0, and it has the default gateway IP of your ISP.
  • This is a lot easier if your VPN provider uses a protocol that creates a virtual network adapter for each VPN (OpenVPN, for example, creates a virtual tun0 interface, PPTP does something similar if I remember correctly - IPSec might give you issues). Let's say you have a cool OpenVPN based provider that gives you an appropriate config file and creates a tun0 for you.
  • Use the ip route command to create a new route saying that any traffic leaving your system destined for must leave via tun0. You need to assign it the proper metric where it always gets used over your actual default gateway.
  • To be really safe, you might want to create some iptables rules that block all traffic going out of your default gateway (eth0, your actual NIC) to This prevents leaking.
  • You need to put your ip route commands in a script that executes on startup.
  • Do this again for your second IP range and VPN.
  • Then, traffic not in either of those IP ranges will leave out eth0 (i.e. your default gateway).

You can find out the IP range of a remote site's ISP pretty easily with whois, unless they use some type of CDN frontend. If a CDN frontend is used, such as Cloudflare, the website will appear to come from a totally different location. In this event you are better off using an HTTP-layer proxy such as squid which can redirect traffic to different IP's based on the content of the URL.

share|improve this answer
Thanks for your reply. This sounds reasonable. I will try to set something like this up. I will let you know, what solution I will come up with ;) – Gunnar Jan 15 '12 at 10:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.