1

I have openvpn client running in my centos box which I use as a router for my internal network. I have two interfaces for reach outside world. 

eth0 - normal internet 
tun0 - openvpn tunnel

I disable the opevpn auto route pulling by putting "route-noexec " option and I handle all the routes manually now. after I up the openvpn tunnel my routing table is like this.

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.80.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.44.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.11.0    0.0.0.0         255.255.255.0   U     0      0        0 dummy0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth1
0.0.0.0         192.168.44.1    0.0.0.0         UG    0      0        0 eth0

Now I have internal host who connected to interface 192.168.80.0 on my centos box 

192.168.80.50

I need to route all traffic from this user through interface tun0 and all other traffic through eth0

I tried adding POSTROUTING rules like this 

iptables -t nat -A POSTROUTING -s 192.168.80.50 -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING  -o eth0 -j MASQUERADE

but all the clients go through only eth0 including 192.168.80.50. how can I achieve this ?

Improve this question
5
  • how your user connected to the box ? through VPN ? or through regular SSH ? or VNC ?
    – Kiwy
    Apr 23, 2018 at 9:40
  • OK could please edit your question to clarify the situation on your topology the comment you put on the answer makes very strange what your asking for does your centos box is a server ? or a router ?
    – Kiwy
    Apr 23, 2018 at 10:01
  • Hi kiwy I edited the question. This is only for openvpn client. Not the server. Box act as a router
    – sameera
    Apr 23, 2018 at 10:08
  • if it's only doing routing because it's a router and not a server people are using, the simplest way to do that won't be by user because a router can't know if a specific user uses the networtk but will be by IP. search for source IP routing you should find your solution. but it will be only base on IP. I'm still not sure to understand what is your current need.
    – Kiwy
    Apr 23, 2018 at 10:11
  • Yes this is purely act as a router and I need to do source IP based routing. My need is people who have use this router as a gateway should be able to use this VPN connection without configure anything without their end. But at the same time other users should be able to use internet and should be able go through eth0
    – sameera
    Apr 23, 2018 at 10:17

3 Answers 3

Reset to default
0

Based from this answer on SuperUser:

create a routing table for some IPs: 

ip rule add from <sourceIP>/<mask> table <name>

Then declare a new route to match the routing table <name>: 

ip route add default via <router> dev tun0 table <name>

it would be easier to have a subnet for people needing to use the VPN because with this configuration you need to specify all the IP in the table <name>

Improve this answer
2
  • Your solution is working but only if I enable the auto configure routes on openvpn profile. btw I'll ask another question based on that issue. thank you for the answer !!
    – sameera
    Apr 25, 2018 at 7:04
  • @charith you're welcome. Glad this could help I even learn about routing table in the process
    – Kiwy
    Apr 25, 2018 at 7:14
0

If you want put all traffic for selected VPN clients through VPN tunnel you must setup this "on the client side" - in this user configuration. In client config file it is option: "redirect-gateway autolocal". On the VPN server you probably must have setup SNAT or MASQUERADE for this VPN clients IPs.

Improve this answer
1
  • This is client side. This is my centos box act as a router for rest of the network
    – sameera
    Apr 23, 2018 at 9:53
0

Take a look at 'iptables source routing' and this post: https://www.linuxquestions.org/questions/linux-software-2/iptables-source-ip-based-gateway-route-681522/

You may create a specific routing table for the VPN clients with a specific gateway (in your case this would be the endpoint of your VPN connection) and simply add an iptables rule pointing to this routing table.

Improve this answer
1
  • It's usually a good idea to include some example and code in your answer as the link you put might change or might get deleted making your answer useless.
    – Kiwy
    Apr 26, 2018 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .