1

How to route traffic to my ipv4 routes except 0.0.0.0 address
because I don't want it to be the default interface

default via 192.168.5.1 dev enp7s0 proto dhcp metric 100 
169.254.0.0/16 dev enp7s0 scope link metric 1000 
192.168.5.0/24 dev enp7s0 proto kernel scope link src 192.168.5.84 metric 100 
192.168.60.0/24 dev vpn_softether proto kernel scope link src 192.168.60.50 
209.80.36.170 via 192.168.60.1 dev vpn_softether 
216.117.82.227 via 192.168.60.1 dev vpn_softether 

I want to make vpn_softether as default interface
What i have already tried ......

ip r add 0.0.0.0/1 via 0.0.0.0 dev vpn_softether 
ip r add 128.0.0.0/1 via 0.0.0.0 dev vpn_softether 

ip r add 0.0.0.0/1 via 192.168.5.1
ip r add 128.0.0.0/1 via 192.168.5.1

ip r add default via 192.168.60.1

ip r del 0.0.0.0/1 via 192.168.60.1 dev vpn_softether 
ip r del 128.0.0.0/1 via 192.168.60.1 dev vpn_softether 

ip r del 0.0.0.0/1 via 192.168.5.1 
ip r del 128.0.0.0/1 via 192.168.5.1 

ip r add 0.0.0.0/1 via 192.168.5.1 dev enp7s0 proto dhcp metric 100 
ip r add 128.0.0.1/1 via 192.168.5.1 dev enp7s0 proto dhcp metric 100


ip r del 0.0.0.0/1 via 192.168.5.1 dev enp7s0 proto dhcp metric 100 
ip r del default via 192.168.60.1 dev vpn_softether 
ip r del 128.0.0.0/1 via 192.168.5.1 dev enp7s0 proto dhcp metric 100 

ip r del 0.0.0.0/1 via 192.168.60.1 dev vpn_softether proto dhcp metric 100 
ip r del default via 192.168.5.1 dev enp7s0
ip r del 128.0.0.0/1 via 192.168.60.1 dev vpn_softether proto dhcp metric 100 

ip r add 0.0.0.0/1 via 192.168.60.1 dev vpn_softether
ip r add default via 192.168.5.1 dev enp7s0 proto dhcp metric 100 
ip r add 128.0.0.0/1 via 192.168.60.1 dev vpn_softether

but it didn't worked... Is there any other way to do it?
Thank you.

1
  • 2
    I edited it to be less confusing, but still a room for a lot of improvement. Could spend a little bit more time making it more clear? Commented Aug 27, 2018 at 7:43

2 Answers 2

1

Note that you can only route "all traffic" to one interface, not to somehow all of them.

If you want to keep your default route (for whatever reasons), leave the default route alone, don't add or remove it. If you can add or remove it, you don't need to keep the default route ...

So,

ip route add 0.0.0.0/1 via 192.168.60.1 dev vpn_softether 
ip route add 128.0.0.0/1 via 192.168.60.1 dev vpn_softether 

should do the job, assuming the gateway on vpn_softether is indeed 192.168.60.1. Note you also need a rule to send whereever your VPN is connected to out of enp7s0, or the VPN won't be able to communicate with the other endpoint, and as a result you won't have any connection at all. So something like

ip route add 1.2.3.4/32 via 192.168.5.1 dev enp7s0

where 1.2.3.4 is the IP address of the other endpoint. Keeping the default rule for this (if this was your motivation for that condition) will not work.

0

I want to add to the previous answer:

ip route add 1.2.3.4/32 via 192.168.5.1 dev enp7s0

It is the wrong approach. This route will disappear when enp7s0 is turned off. This route won't appear when enp7s0 goes online. Meanwhile, your VPN interface will be online, but it won't work because it won't be able to reach 1.2.3.4.

You can dynamically create this route using netplan once enp7s0 is up. But this route consists of an IP address, a network interface name, and a gateway IP. It means it is not portable across different networks. Practice shows that this solution is too painful and therefore not recommended. You will forget about the fact that you added an important route to netplan in the short term. Later, this route will become an issue for you. It is completely impossible to use this solution on a large network.

The right solution is to exclude 1.2.3.4 from default route you are creating for VPN traffic redirection. For example solution for wireguard. You need to exclude 1.2.3.4/32 from 0.0.0.0/0 and put result in AllowedIPs. Online calculator is here. You can read there a paragraph "a better alternative", but author is wrong, there are no alternatives.

For example 0.0.0.0/0 minus 1.2.3.4/32 will be:

AllowedIPs = 0.0.0.0/8, 1.0.0.0/15, 1.2.0.0/23, 1.2.2.0/24, 1.2.3.0/30, 1.2.3.5/32, 1.2.3.6/31, 1.2.3.8/29, 1.2.3.16/28, 1.2.3.32/27, 1.2.3.64/26, 1.2.3.128/25, 1.2.4.0/22, 1.2.8.0/21, 1.2.16.0/20, 1.2.32.0/19, 1.2.64.0/18, 1.2.128.0/17, 1.3.0.0/16, 1.4.0.0/14, 1.8.0.0/13, 1.16.0.0/12, 1.32.0.0/11, 1.64.0.0/10, 1.128.0.0/9, 2.0.0.0/7, 4.0.0.0/6, 8.0.0.0/5, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/1

Unfortunately, this solution is not ideal: you can have multiple VPNs, and therefore you have to exclude all endpoint IPs from every VPN default route.

For example, if you have 2 VPNs and you want to add another one, you have to exclude the third endpoint IP from the allowed IPs of the two existing VPN configs. It will be better if wireguard has internal calculator or DisallowedIPs functionality.

So my solution is to omit AllowedIPs in config and create default routes yourself. I am using the following calculator-excluder written in python. You need to do the following:

  1. Collect all endpoints from all wireguard client configs.
  2. Resolve all endpoints.
  3. Exclude target endpoints from 0.0.0.0/0 (and from ::/0).
  4. Add default routes for each ip block you received from calculator.

PS I can recommend you to add these routes into separate table for each VPN interface. Because it will be a bunch of them.

PS I've made my route-up.client.sh and route-down.client.sh as public gist here.

Table = off
PostUp = /etc/wireguard/route-up.client.sh 51820 wg0 10.20.3.0/24 fd10:20:3::/64 10
PreDown = /etc/wireguard/route-down.client.sh 51820

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .