10

I'm using a proprietary VPN client on my Ubuntu Linux work station (Astrill) which support several types of VPNs. One of these VPN types is OpenVPN, which creates a virtual interface tun0 when connected.

What confuses is me is that when I choose OpenVPN in the client I have the option to only route the traffic from certain applications on my computer via the VPN, while the traffic from other applications does not use the VPN and leaves my computer via the physical interface.

I thought I kind of understand how routing in Linux works, but I can't see/understand how this VPN client manages to route the traffic differently per application.

When I enable this per-application routing I can see that the client adds the following entry to the routing table, but nothing else:

198.18.32.0/21 dev tun0  proto kernel  scope link  metric 950

There is not a single IPTables rule, so it's not done via IPTables.

Does somebody have a clue how it might be doing that?

Improve this question
2
  • Does your VPN solution install kernel modules?
    – Alex Stragies
    Commented Oct 7, 2015 at 19:26
  • No, it's just an application which i start as user, and then it starts some daemons as root via the setuid bit. It does not add a kernel module.
    – replay
    Commented Oct 7, 2015 at 21:36

1 Answer 1

Reset to default
4

By setting NameSpaces on linux you can achieve this, you can have different processes to have different networks or routings.
For example
To create a new namespace named test:
ip netns add test

To assign a network interface(or tunnel interface):
ip link set tun0 netns test

A network interface can just be active in one namespace at a time.

To execute a program in that namespace you can do this:
ip netns exec test <command to run against that namespace>

more info on ip net-ns
more info on namespace

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .