I am using NetworkManager (Gnome) to handle all my network connections. I am connecting to a VPN with OpenVPN. My firewall (nftables) drops all traffic outside of the tun0 interface.

Now I want to connect to a server (that has a static IP) via ssh, but outside of the VPN tunnel, so I want to tell my machine: For every connection to this IP, do not use the VPN but rather connect directly.

What I did so far: Allow a connection to the server in the firewall.

What I am not really able to figure out: How do I make my machine connect to the server "outside" of the VPN properly? I already tried to read up on the problem, the answer I have been able to find was routing, so I am supposed to create a route for all the traffic to the server through a different networking interface, so instead of letting those packages through tun0, they are supposed to go through either wlp2s0 or enp1s0, depending on how I am connected at a given moment.

So I did for example ip route add IP-ADDRESS dev wlp2s0

This somehow seems to work temporarily (but I don't even know if it should). I am not sure though if this is the correct way to do it. In case that this is the right idea, I want to configure it so this routing is done "automatically" - so whenever my network connection changes (for example I'm switching from wifi to wired connection), I want the route to still be there. How do I do that properly?

My system (not sure if this is relevant) is Archlinux with all the latest packages installed.

The reason I want to do this is because the server I want to connect to is blocking all of the IPs from my VPN provider. I do trust the server though, so I do not need to use the VPN to connect to this server.

  • 1
    The question need not probably be so convoluted. I bet you would manage to convey you want to escape the normal route of VPN with less than 1/3 of that text. And yes, if you want to mess up with routing, the best course of action is understanding the route (and possibly firewalling) commands. – Rui F Ribeiro Nov 19 '18 at 14:22
  • Yes, adding the route for that address is the correct way to do it, and should of course work. – RalfFriedl Nov 19 '18 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.