Multiple VPN connetions, routing based on country

Question

I want to set up a couple of VPN connections to two different countries, A and B, on my Ubuntu Server. Then I would like to set up rules based on GeoIP to determine which VPN connection should be used when I surf the internet. If the website I browse is in country A then I should use VPN connection A, if it is in country B then I should use connection B, and if it is in neither A nor B then I shouldn't use either of the VPN connections (default should be my DSL connection).

Is this possible to set up?

Answer 1

I don't know of an "out-of-the-box" solution that does this completely automatically and seamlessly. It is possible. The best I can do is provide a "high-level" summary.

Basically, you are looking at a routing problem. You want traffic destined to specific subnets to travel over different gateway IP addresses. If you are willing to live without a dynamic solution, you can do the following:

• Find out what subnets represent the traffic in "different countries" and which VPN you want them to use. Let's, for example, say that anything in 10.4.0.0/16 is in a different country and you do NOT want it leaving except via a VPN. You have your modem connected to eth0, and it has the default gateway IP of your ISP.
• This is a lot easier if your VPN provider uses a protocol that creates a virtual network adapter for each VPN (OpenVPN, for example, creates a virtual tun0 interface, PPTP does something similar if I remember correctly - IPSec might give you issues). Let's say you have a cool OpenVPN based provider that gives you an appropriate config file and creates a tun0 for you.
• Use the ip route command to create a new route saying that any traffic leaving your system destined for 10.4.0.0/16 must leave via tun0. You need to assign it the proper metric where it always gets used over your actual default gateway.
• To be really safe, you might want to create some iptables rules that block all traffic going out of your default gateway (eth0, your actual NIC) to 10.4.0.0/16. This prevents leaking.
• You need to put your ip route commands in a script that executes on startup.
• Do this again for your second IP range and VPN.
• Then, traffic not in either of those IP ranges will leave out eth0 (i.e. your default gateway).

You can find out the IP range of a remote site's ISP pretty easily with whois, unless they use some type of CDN frontend. If a CDN frontend is used, such as Cloudflare, the website will appear to come from a totally different location. In this event you are better off using an HTTP-layer proxy such as squid which can redirect traffic to different IP's based on the content of the URL.