0

I have a basic Ubuntu 18.04 setup where the computer has two interfaces - one for internal (enp4s0) and one that heads to the internet (enp5s0). On the internet interface I successfully have a VPN (tun0) in place, which takes over all outbound traffic to enp5s0 so that internet traffic is protected by the VPN.

What I am trying work out is - how do I get one host inside my network (for example 192.168.1.220) to stay outside of the VPN and head out through enp5s0. I don't want it to be inside the VPN.

Can anyone advise on what I need to do to my routes? I believe I have to set up a table via iproute2 but I've had no luck getting it to work.

Route Table (VPN enabled)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.8.1        128.0.0.0       UG    0      0        0 tun0
default         _gateway        0.0.0.0         UG    0      0        0 enp5s0
10.8.8.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
45.248.79.198   _gateway        255.255.255.255 UGH   0      0        0 enp5s0
128.0.0.0       10.8.8.1        128.0.0.0       UG    0      0        0 tun0
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 enp5s0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 enp4s0
192.168.8.0     0.0.0.0         255.255.255.0   U     0      0        0 enp5s0

Route Table (VPN disabled)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    0      0        0 enp5s0
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 enp5s0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 enp4s0
192.168.8.0     0.0.0.0         255.255.255.0   U     0      0        0 enp5s0

UFW Rule (to get LAN traffic to VPN)

-A POSTROUTING -s 192.168.1.0/24 -o tun0 -j MASQUERADE
  • When the VPN is down and I do a trace from 192.168.1.220 I get: Tracing route to www.google.com [172.217.25.132] over a maximum of 30 hops: 1 1 ms 1 ms 1 ms BOB [192.168.1.100] 2 1 ms 4 ms 3 ms SAGEMCOM [192.168.8.1] Which is the correct hop, and what I'm trying to force even when the VPN is up. – Matt Aug 18 '18 at 12:33
1

You need policy routing, so something along the lines of

ip route add table 250 default dev enp5s0
ip rule add from 192.168.1.220 table 250

I'm not sure where _gateway points to, you may have to add via a.b.c.d in the first line. Also, I'd recommend to use the newer ip route over the older route.

  • Gateway points to the enp5s0 interface (192.168.8.2), which then heads out to the DSL modem (192.168.8.1) so I tried doing the following to no avail: route changes $ sudo ip route add table 250 192.168.8.1 dev enp5s0 $ sudo ip rule add from 192.168.1.220 table 250 ** results** $ ip route show all default via 192.168.8.1 dev enp5s0 onlink A tracert from 192.168.1.220 still shows the traffic going via tun0 though, not enp5s0. – Matt Aug 18 '18 at 12:27
  • 1
    Use ip route show table 250 to verify route, also try ip route add table 250 default via 192.168.8.2 dev enp5s0 as already mentioned. Veryify with ip route get a.b.c.d from 192.168.1.220 iif enp4s0 that the rules work. – dirkt Aug 18 '18 at 13:58
  • yes all routes on main table for enp5s0 have to be duplicated on table 250 (ok except the non-needed route to vpn) – A.B Aug 18 '18 at 15:10
  • I'm not sure if I'm not misunderstanding you, but: Table 250 should only contain the new default route for 192.168.1.220. If should not contain all the other routes in the main table. If it does, of course all traffic will go again through tun0. – dirkt Aug 18 '18 at 15:38
  • ok it's not needed in this case to duplicate all routes with enp5s0 (as long as via 192.168.8.1 is added) I was wrong. – A.B Aug 18 '18 at 17:54
0

It always takes some puzzling to get a network layout from these tables. As I see it:

  • you have two physical interfaces, enp4s0 and enp5s0
  • enp4s0 is directly connected to 192.168.1.0/24
  • enp5s0 is directly connected t0 192.168.8.0/24
  • your host _gateway is on 192.168.8.0/24
  • your tunnel endpoint is 45.248.79.198

The routing-table you provide has something strange:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.8.1        128.0.0.0       UG    0      0        0 tun0    
128.0.0.0       10.8.8.1        128.0.0.0       UG    0      0        0 tun0

You are splitting the Internet in two halves, both go through tun0.

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    0      0        0 enp5s0

Your default-gateway is still _gateway

I would have expected the routing-tabel to look like:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.8.8.1        0.0.0.0         UG    0      0        0 tun0
10.8.8.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
45.248.79.198   _gateway        255.255.255.255 UGH   0      0        0 enp5s0    
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 enp4s0
192.168.8.0     0.0.0.0         255.255.255.0   U     0      0        0 enp5s0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

To go to your question: 192.168.1.220 is on a direct connected network. It will therefore not to a gateway, if it is pure a routing issue.

  • The "splitting the internet in two halves" is a standard trick used by many VPN applications to keep the default rule, but supply a new "default" rule that's more specific and will overwrite the old default rule. – dirkt Aug 18 '18 at 13:46
  • this splitting allows to be 100% sure to override the "usual" default route even if its metric is 0 (as seen here) without having to delete it and without risking an other tool (network manager etc) replaces the vpn's default route with the former default – A.B Aug 18 '18 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.