I have a Debian Linux VPN router myvpnserver with 2 interfaces, eno1 and eno2:

  • eno1 is connected to a LAN and an internet router. On this interface with static IP address, myvpnserver has its default gateway (to the Internet). OpenVPN connects to a VPN server using this internet connection.
  • eno2 is connected to a switch. A DHCP server runs on this interface. I want all the traffic from clients connected to eno2 to be routed through the VPN / tun0.

The basic setup works fine. From hosts attached to eno2 I can reach hosts in the remote VPN LAN (e.g.

My next goal is routing on myvpnserver depending on the source address or interface.

If myvpnserver connects to the Internet (e.g. ftp.debian.org or VPN host), it should use the default gateway via eno1. If a client attached to eno2 wants to connect to the same Internet hosts (e.g. ftp.debian.org), the traffic should be routed through the VPN / tun0 instead of myvpnserver 's default gateway.

// For Incoming Traffic:
If( InputInterface = eno2 ) Then
    default_gateway =
    default_gateway = gateway as declared in /etc/network/interfaces
End If

I found out policy-based routing seems to be the way to go. While "normal" routing is based on the destination only, policy-based routing is said to be able to consider additional aspects like the input interface or source IP range.

What are the steps to take? (I'm on Debian 11 / Bullseye.)

1.) I added a row 1000 vpntunnel to /etc/iproute2/rt_tables.

What's next? Can you point me to a configuration example?

Thanks a lot for any advice!

  • Is myvpnserver doing NAT itself through tun0 (and while at it through eno1 too)? Since it's not needed and should be avoided if the remote VPN peer can be configured adequately, such information simplify understanding of the setup. But then of course other configurations should be provided. eg: the fact that without this NAT various remote routes must be added to various routing equipments' route, not yet talking about policy routing.
    – A.B
    Commented Nov 21, 2022 at 16:02

1 Answer 1


The next steps to take might be as simple as adding one policy rule and one routing table entry.

You can try:

ip route add default via table 1000
ip rule add type unicast iif eno2 table 1000 pref 30000

I'm assuming that is the other end of your VPN tunnel. I used the numerical value of 1000 for the table, but since you added an entry with name "vpntunnel", you could use the name.

Your VPN might already have some configuration setup that could conflict with what I'm suggesting. The outputs of "ip rule show" and "ip route show table all" could be useful in the question. Also, existing iptables configuration could also require a change to the suggested solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .