Currently I use a ip table to divide traffic when using OpenVPN, achieving this by running a script to sudo route add a list of IPs I like to connect directly.

This posts an issue. When I request a url, it still would run via OpenVPN's DNS, and return an IP that might not be usable if I connect it directly (I am in China, GFW blocks Facebook, Google, and a lot of foreign IPs/domains, so I can't use local DNS either).

Ideally, I would have ACL or PAC where it does a local DN first and figure out which DNS (local or international) to use and connect according. How would this be done under Linux or Unix?


First, when doing routing, it's usually not necessary to also use iptables, unless you want to do something complicated for some reason.

You didn't say if you are splitting the traffic based on a list of complete addresses, or if you are splitting by prefixes etc. So please edit your question and provide this information.

If you split based on complete addresses, the simplest solution is to just add names for those addresses to /etc/hosts. Lookup in this file takes precedence over DNS lookup (unless configured otherwise in nssswitch.conf). Of course, both the IP addresses in this file and in your routing file need to be updated if changed.

Another option is to use /etc/resolv.conf. From man 5 resovler:

nameserver Name server IP address

Internet address of a name server that the resolver should query [...] Up to MAXNS (currently 3, see ) name servers may be listed, one per keyword. If there are multiple servers, the resolver library queries them in the order listed.

However, this file is usually automatically generated by various other parts of the system, and the details differ from Linux distribution to Linux distribution. So you must find out which scripts are executed for your DHCP client and/or OpenVPN to update this file with the received nameserver information, and then modify those scripts so both nameserver entries end up in resolv.conf in the correct order.

In this form, it will only work if the Chinese DNS server fails to return an IP address for blocked domains. If the Chinese DNS server behaves differently, e.g. if you have to test the IP returned to find out if it's blocked or not, or if you need different kind of tests, it will even get more difficult: You'll have to use some kind of local DNS proxy that does those tests, and probably modify the code of an existing proxy software.

I would assume other people in China who have used VPNs already have run into the same problem, so possibly there's also some ready-made solution out there, but the international community likely doesn't know about those.

  • Adding names to /etc/hosts does not override the behavior of the traffic - it still goes through VPN. – Aero Wang Nov 14 '17 at 2:41
  • Using a VPN essentially makes my traffic none-Chinese, which means the DNS will return IPs of Chinese domains outside of China (if they have servers abroad) - which means slow/unusable network - and sometimes Chinese domains's foreign servers don't provide similar services (for example most of the real time database providers), resulting at call chain failure... – Aero Wang Nov 14 '17 at 2:47
  • Of course you need proper ip route rules, so Chinese IPs (prefixes) don't go through the VPN, while the rest does. That's a different problem, I thought your main problem was IP lookup (DNS service): Return either the Chinese or non-Chinese IP based on your preference. – dirkt Nov 14 '17 at 6:29
  • thats very primative and stated in the question that i am doing this. it also doesnt do domain recognition like pac does. so it must go through the dns which leads to the same problem described about. – Aero Wang Nov 14 '17 at 18:59
  • If you only want this for HTTP traffic (and you didn't say so in the question), then yes, a proxy would be a solution. See e.g. here. (Though that still doesn't explain why /etc/hosts doesn't work for you ...). – dirkt Nov 14 '17 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.