0

I want to connect to a VPN but not send all traffic through it.

Here is how my network is setup with the VPN redirecting all traffic. This is the default with the vpn config not changed.

$ ip rule show
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

$ ip link show        
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether bc:5f:f4:0e:04:bb brd ff:ff:ff:ff:ff:ff
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen 100
    link/none

$ ip route list
0.0.0.0/1 via 10.35.0.98 dev tun0
default via 192.168.1.1 dev enp4s0
10.35.0.1 via 10.35.0.98 dev tun0
10.35.0.98 dev tun0 proto kernel scope link src 10.35.0.97
128.0.0.0/1 via 10.35.0.98 dev tun0
[VPN PUBLIC IP] via 192.168.1.1 dev enp4s0
192.168.1.0/24 dev enp4s0 proto kernel scope link src 192.168.1.8

When I configure the vpn to not redirect all traffic, the routes change.

$ ip route list
default via 192.168.1.1 dev enp4s0
10.35.0.1 via 10.35.0.98 dev tun0
10.35.0.98 dev tun0 proto kernel scope link src 10.35.0.97
192.168.1.0/24 dev enp4s0 

Attempting to use the tun0 interface does not work when the VPN is configured to not redirect all traffic. This curl command just hangs.

curl google.com --interface tun0

How can I configure my network so that when I attempt to use the tun0 interface directly, I can still send traffic through the VPN.

I have looked into routing, but I can't find out how to route traffic for a specific network interface. Everything I read is about routing source/destination addresses.

0

You can't just "use the tun0 interface", that's not how the IP stack works. While you can tell some applications to "bind" to a specific interface, the application will still need the rest of the network stack to be set up properly, including routes and gateways, so you can't use this to "switch" between outbound connections at will.

So either you can classify the traffic you want to route via the VPN as opposed to the traffic you don't want to use the VPN by source or destination address. Then you can do normal routing or policy routing (if you classify by source address) to make the distinction.

Or you have some applications you want to use the VPN, while the rest of the applications shouldn't use the VPN. In that case, create a network namespace, put the VPN endpoint in that namespace, and start the applications which should use the VPN in that namespace.

If you have some other criteria to distinguish between VPN and non-VPN use, please edit your question and specify them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.