I'm using a proprietary VPN client on my Ubuntu Linux work station (Astrill) which support several types of VPNs. One of these VPN types is OpenVPN, which creates a virtual interface tun0 when connected.

What confuses is me is that when I choose OpenVPN in the client I have the option to only route the traffic from certain applications on my computer via the VPN, while the traffic from other applications does not use the VPN and leaves my computer via the physical interface.

I thought I kind of understand how routing in Linux works, but I can't see/understand how this VPN client manages to route the traffic differently per application.

When I enable this per-application routing I can see that the client adds the following entry to the routing table, but nothing else: dev tun0  proto kernel  scope link  metric 950

There is not a single IPTables rule, so it's not done via IPTables.

Does somebody have a clue how it might be doing that?

  • Does your VPN solution install kernel modules? – Alex Stragies Oct 7 '15 at 19:26
  • No, it's just an application which i start as user, and then it starts some daemons as root via the setuid bit. It does not add a kernel module. – replay Oct 7 '15 at 21:36

By setting NameSpaces on linux you can achieve this, you can have different processes to have different networks or routings.
For example
To create a new namespace named test:
ip netns add test

To assign a network interface(or tunnel interface):
ip link set tun0 netns test

A network interface can just be active in one namespace at a time.

To execute a program in that namespace you can do this:
ip netns exec test <command to run against that namespace>

more info on ip net-ns
more info on namespace

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.