Redirect traffic through vpn on an as needed basis

Question

My problem is really simple yet it sounds complex, but I have zero to none experience with this.

I have set up a box using gentoo which has its own semi-static WAN-IP and acts as router for my LAN. I have access to a router elsewhere on the web, which has a dynamic IP and is registered to dyndns. My plan is to redirect specific traffic from my gentoo-box to the router to make use of the tunnel and the dynamic IP.

My idea was to install a proxy on my gentoo-box which uses a VPN connection to the router as default. Every computer on the LAN and specific computers on the WAN (that have access right to the proxy) should be allowed to use this proxy, but no traffic should be forced to go through the router. Which rules out the idea of just using iptables.

Example: I want to redirect Firefox traffic through the VPN but not Opera traffic. I setup Firefox to use the local proxy, it gets the dynamic IP of the distant router, Opera still browses with my semistatic-IP.

Is this possible? Which software to use? Any further ideas?

btw: the router supports PPTP, IPSec and L2TP

Edit: If you have better ideas for the title please edit or suggest, I have no idea how to call my problem :(

Answer 1

There is no practical way to select different routes on an application-by-application or process-by-process basis. (Linux had one for a time: iptables --cmd-owner, but that disappeared in kernel 2.6.14). See Linux : restricting outgoing on an application basis.

You can select different routes on a user-by-user basis with iptables --uid-owner, or select different routes for different virtual machines. So given your requirements, you can use iptables, as long as you run the proxy as a dedicated user.

ip rule add fwmark 1 table 1
ip route add 0.0.0.0/0 table 1 dev tun0
iptables -t mangle -A OUTPUT -m owner --uid-owner proxy -j MARK --set-mark 1

See Dual network connection for explanations.

Answer 2

As I understand, seems to be you need socks 5 server.

Socks server can easily be done with SSH server with one command:

ssh -D 8080 [email protected]

you can use socksify for linux or sockscap for windows to apply specified proxy settings to any application on your computers.

Answer 3

If you (only) want to do this for HTTP traffic, you could use privoxy.

So every device (on the apps that need it) would set the privoxy server on the gentoo box as their proxy. I believe you could than use the {+forward-overwrite {127.0.0.1:9876}} (see man) and use an iptables rule that everything at :9876 gets forwarded through the VPN to a new privoxy instance that does nothing.