0

I have a DD-WRT router with an OpenVPN service configured. I'd like to send only certain source IP's over the vpn connection.

I believe my current routing table (as seen with netstat -rn) sends all my traffic over the vpn on interface tun1. From what I understand the routing table is a "fall through" table so in this case because the 1st entry is 0.0.0.0 all traffic will go through the tun1 interface.

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.182.1.5      128.0.0.0       UG        0 0          0 tun1
0.0.0.0         10.0.1.1        0.0.0.0         UG        0 0          0 br0
10.0.1.0        0.0.0.0         255.255.255.0   U         0 0          0 br0
10.182.1.1      10.182.1.5      255.255.255.255 UGH       0 0          0 tun1
10.182.1.5      0.0.0.0         255.255.255.255 UH        0 0          0 tun1
46.23.68.178    10.0.1.1        255.255.255.255 UGH       0 0          0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
128.0.0.0       10.182.1.5      128.0.0.0       UG        0 0          0 tun1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 br0

My goal is to only route 1 or 2 websites via the Website - specifically a1505.g2.akamai.net which according to NSLookup maps to the following IPs

  • Address: 195.59.150.43
  • Address: 195.59.150.26

I believe what is required is 3 steps.

1) Issue some sort of iptables command to delete the 1st routing entry - which in doing so would stop sending traffic through the vpn tun1 2) Issue two commands to tell the destination 195.59.150.43 and 195.59.150.26 to route through tun1

However i find iptables to be rather confusing in all honesty.

Is this the correct approach and if so could somebody perhaps give me a sample command or two?

Thanks!

1

I understand the routing table is a "fall through" table

Not really. The routing table is ordered from "most specific route" to "least specific route". Your default route is via br0, and is defined as the route of last resort because there is no netmask (i.e. genmask is 0.0.0.0).

because the 1st entry is 0.0.0.0 all traffic will go through the tun1 interface

Although this is the correct conclusion, unfortunately it's the wrong reasoning. Here is your routing table ordered visually to represent the order used for routing (top is best match):

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.182.1.1      10.182.1.5      255.255.255.255 UGH       0 0          0 tun1
10.182.1.5      0.0.0.0         255.255.255.255 UH        0 0          0 tun1
46.23.68.178    10.0.1.1        255.255.255.255 UGH       0 0          0 br0

10.0.1.0        0.0.0.0         255.255.255.0   U         0 0          0 br0

169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 br0

127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo

0.0.0.0         10.182.1.5      128.0.0.0       UG        0 0          0 tun1
128.0.0.0       10.182.1.5      128.0.0.0       UG        0 0          0 tun1

0.0.0.0         10.0.1.1        0.0.0.0         UG        0 0          0 br0

The default route is still via br0. However, there are two more specific routes (the netmask is 128.0.0.0) each of which will match half the numerically available IPv4 address space, so these will match all non-local traffic.


My goal is to only route 1 or 2 websites via the Website - specifically a1505.g2.akamai.net which according to nslookup maps to the following IPs: 195.59.150.43 and 195.59.150.26.

I'm not sure what you mean by "the Website"; I'm going to assume that's tun1 and that you want to stop all your traffic going that way.

To do this with OpenVPN you simply remove the directive route-gateway def1 from its configuration file. (If you're using something like NetworkManager then there should be an option you need to untick that marks the connection as your default route.)

Having done this all you need to do is to add two routes, one for each host, via the gateway for tun1:

route add -host 195.59.150.43 gw 10.182.1.5
route add -host 195.59.150.26 gw 10.182.1.5

These are host routes so the netmask is implicitly /32 (i.e 255.255.255.255), so they take precedence over everything and in my visually ordered table would be with the three entries at the top of the list.

Actually, you should be able to do this in the OpenVPN configuration file, too. This would allow the routes to be brought up and removed automatically with the VPN itself. Depending on your setup the configuration would either be in the server, where the routes would get "pushed" to the client, or as directives in the client's OpenVPN configuration file:

route 195.59.150.43
route 195.59.150.26
  • By "website" I mean the two host IP's. You got my jist in any case. – Jeef May 9 '15 at 23:13
  • Could you update the answer to also show how to remove a route? - I'm not sure I'm able to disable the VPN default routes – Jeef May 9 '15 at 23:19
  • @Jeef, route delete 0.0.0.0/1 gw 10.182.1.5 and route delete 128.0.0.0/1 gw 10.182.1.5. Fixing the configuration would be preferable, though. – roaima May 9 '15 at 23:21
0

I think you can use route command instead of iptables:

route 111.112.113.114 gw 10.182.1.5

Or you can also push the route from openvpn server's side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.