My ISP uses a Carrier Grade NAT (a switch inbetween ISP line and my primary router) and that doesn't allow me to do portforwarding (I have set it up but to no use). After much contemplation, I have decided to go for a VPN. On doing some research, I came to know that you can have two routes using iptables based on the direction of your connection.

Apparently, the converse of what I need seems to be here (Incoming/Outgoing seperation for VPN).

Will this setup even work for stuff like torrents and perhaps extend couple of services from my home network? How can I implement this in my home network?

P.S: Based on the idea given by @roaima, I followed this guide to setup two routes with the VPN route being used by vpn user. This is the detailed guide to follow. http://www.htpcguides.com/configure-transmission-for-vpn-split-tunneling-ubuntu-16-04-debian-8/

  • You're overthinking it. Just don't set the VPN to have your default route and it'll all work straight off Jan 20, 2017 at 19:37
  • True. Can you please elaborate? I'm new to this no-portforwarding thing and all I want to do is use internet as usual on my RPi yet let the torrents in it get seeded through VPN. Thanks!
    – mccbala
    Jan 21, 2017 at 18:15

1 Answer 1


You don't need to do anything special at all for this just to work straight off.

The system's default route should remain via your ISP. This means that all packets that aren't addressed to devices on your local network (the LAN) will go via your ISP.

Create a VPN to your required endpoint. If you're using something based on OpenVPN ensure that your default route is not updated to use the VPN. (In the configuration file this is typically achieved with the redirect-gateway def1 - you do not want this.)

All traffic initiated from your system will leave via the default route to your ISP. When the VPN fires up this will continue, except for traffic targeted at the far end of your VPN link; this will be encapsulated by the VPN and then the encrypted data will leave your system to your ISP.

Since your VPN connects your system to a remote system you should consider a firewall. Typically a few iptables rules will help.

You also need to consider why you want the VPN. Is it to allow incoming ssh or http? If so you will probably need an SNAT (MASQUERADE) rule applied at the remote end of the VPN link so that your system knows to send return traffic back across the VPN. Be aware, though, that this may well not work for Torrents.

  • Thanks for the idea. I searched based on this idea and followed this guide to setup a differnt user for VPN. htpcguides.com/…. So now I have two routes, one for each user in my system.
    – mccbala
    Jan 22, 2017 at 3:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .