1

I have been plugging away but not luck, but from what I understand what I am trying to split tunnel. I have a VPN in place (and working) where all traffic from my LAN heads out to the internet via the VPN. My challenge is that I would like to have two hosts within the LAN go to the internet directly (i.e. a TV that has Netflix, and an Xbox) and bypass the VPN in place.

I have tried making changes to my OpenVPN config but they haven't worked (currently commented out in the below files), and I suspect it stems from my routing table being an issue.

Can anyone shed light on where I'm going wrong?

Interfaces

Internal/LAN: enp4s0
Internet: enp5s0
VPN: tun0

OpenVPN Config

client
dev tun
proto udp
remote 45.248.79.198 1194
resolv-retry infinite
remote-random
nobind
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
explicit-exit-notify 3
remote-cert-tls server
#route-nopull 
#route 192.168.1.236 255.255.255.255
#push "route 192.168.1.241 255.255.255.0 default"
#push "route 192.168.1.220 255.255.0.0 gateway"
auth-user-pass pw.txt
comp-lzo
verb 1
pull
fast-io
cipher AES-256-CBC
auth SHA512
disable-occ
script-security 2
#route-noexec

Route Table (VPN enabled)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.8.1        128.0.0.0       UG    0      0        0 tun0
default         _gateway        0.0.0.0         UG    0      0        0 enp5s0
10.8.8.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
45.248.79.198   _gateway        255.255.255.255 UGH   0      0        0 enp5s0
128.0.0.0       10.8.8.1        128.0.0.0       UG    0      0        0 tun0
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 enp5s0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 enp4s0
192.168.8.0     0.0.0.0         255.255.255.0   U     0      0        0 enp5s0

Route Table (VPN disabled)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    0      0        0 enp5s0
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 enp5s0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 enp4s0
192.168.8.0     0.0.0.0         255.255.255.0   U     0      0        0 enp5s0

UFW Rule (to get LAN traffic to VPN)

-A POSTROUTING -s 192.168.1.0/24 -o tun0 -j MASQUERADE
  • Just 2 quick ideas FWIW: 1. OpenVPN has a forum that might give you access to more SMEs, and 2. OPNsense on a 3-NIC box might make your chore easier. – Seamus Aug 15 '18 at 23:48
  • Thanks for the suggestion on OPNsense, but that would seem to mean replacing Ubuntu as my OS which I am not as keen on doing as it runs a number of services for me. That said I'll hit up the OpenVPN forum and see what they say there. Thank you! – Matt Aug 16 '18 at 4:33
0

Closing this one out.

From talking to my VPN provider you can't edit the server.conf file as it sits on their side. So the resolution for a request like this is not within the OpenVPN settings, but in your route table instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.