I want to route all traffic from computer_X
over the vpn client except outgoing traffic
(I can also install a vpn-server on the client if that makes it easier).
Incoming connections, such as requests to my webserver :80 or :443 or ssh :22, will still be routed by default via my WAN interface, but outgoing connections, such as :80 requests from my computer_X
should be routed over the vpn client.
I added a rule to always use the WAN_GATEWAY as default route for packets that origin from my WAN_INTERFACE. See:
# ip route show table 42
default via WAN_GATEWAY dev eth0
# ip rule list
0: from all lookup local
32765: from WAN_IP lookup 42
32766: from all lookup main
32767: from all lookup default
# ip r
default via WAN_GATEWAY dev eth0 onlink
10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
WAN_SUBNET/26 via WAN_GATEWAY dev eth0
WAN_SUBNET/26 dev eth0 proto kernel scope link src WAN_IP
# ip a
eth0: inet WAN_IP ...
tun0: inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
Now I want to route all outgoing traffic over my tun0 device, but I can't just ip route add default via 10.8.0.1
, because you can't route a tunnel over itself?
But maybe I can still do a default route with
ip route default via 10.8.0.1
but additionally create a specific route for the vpn connections like so?
ip route add table 32 default via WAN_IP
ip rule add from 10.8.0.0/8 table 32
I was hoping that this would prevent the vpn doesn't routing through itself.
Or do I have to add all routes for all subnets except 10.8.0.0/8 manually (to make sure that the tunnel is not tunneling itself)?
ip route add 128.0.0.0/1 via 10.8.0.1
ip route add 64.0.0.0/2 via 10.8.0.1
ip route add 32.0.0.0/3 via 10.8.0.1
ip route add 16.0.0.0/4 via 10.8.0.1
ip route add 12.0.0.0/6 via 10.8.0.1
ip route add 11.0.0.0/7 via 10.8.0.1
ip route add 9.0.0.0/8 via 10.8.0.1