I'd like to use my VPN for all network traffic except for the traffic from a single, arbitrary command. Is there a way to do this?

I understand there may be easier ways to do roughly what I want; for example, if my command were ssh, I could set up routing so that outgoing connections to port 22 don't go through the VPN. This has the limitation, though, that I have to know the ports my command uses, and that if I ran another ssh session at the same time, it would also not go through the VPN; I just want the one command to do that. I'd also like for this to work regardless of what ports the command uses or what addresses it connects to (which I haven't so far been able to find an example of anywhere).


  • 1
    It would probably help to know what command you are using. As of now I'm thinking you could setup a script that will grab the IP you are trying to execute the command against, create a temporary route for that IP that bypasses your vpn, executes the command, and then remove the route. – Jesse_b Aug 4 '17 at 19:31

One way to run commands which are routed differently is to use iptables and policy routing. You can create a new user (or group) which you use to run the command.

Mark the traffic in mangle table using iptables owner module. In this example traffic is marked with identification 10 for user novpn:

iptables -t mangle -A OUTPUT -m owner --uid novpn -j MARK --set-mark 10

Create a new routing table (table 100) for marked traffic and set a default route and rule to apply the new routing table for marked traffic:

ip route add table 100 default via *DEFAULTGW*
ip rule add fwmark 10 table 100
ip route flush cache

Now to run command which isn't routed via your VPN you can use su etc. to run the command as the new novpn user.

If creating a new user to run commands as is not acceptable, you could set up a separate network namespace with its own routing to run your commands in.

  • Thanks! I tried this, but I end up completely unable to connect to the internet as novpn when my VPN is active. Any idea why? pastebin.com/tRM5w7e2 – charliegreen Aug 22 '17 at 23:52
  • Did you verify your traffic gets marked in mangle table (check counters using iptables -L -v -t mangle)? Can you reach your gateway as vpn user, if you can can you ping hosts in internet (using IP address instead of DNS name)? Does your VPN alter DNS configuration? – sebasth Aug 23 '17 at 0:01
  • I just checked, it does get marked. My VPN does alter DNS config, but it's not just a DNS resolution issue; ping as novpn can't reach plain IP addresses either (nor can wget etc). As novpn I can ping my gateway though. – charliegreen Aug 23 '17 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.