How to work remotely through employer's VPN and at the same time secure everything else with NordVPN?

Question

So, the goal is simple:

• I want to work remotely within an employer's VPN network
• While at the same time, I want to route everything else through NordVPN

In the end, everything should go through some VPN service, either employer's, or NordVPN.

---

I have some requirements, though:

• NordVPN threat protection should be turned on (so DNS settings is not possible)
• I don't want to manually alter iptables
• I'd like the setup to be more-or-less automated

Answer 1

What I found that works for me, is this initial setup:

1. Disconnect from NordVPN temporarily.
2. Fully establish employer's VPN.
3. See ip route with lines containing the via keyword and the tun/tap device.
   • and extract the list of employer's subnets
4. Submit nordvpn whitelist add subnet CIDR_NOTATION for each subnet.
   • note that all single IP addresses must be converted to CIDR notation with /32 suffix
5. Connect to NordVPN again.

After that, I do have fully working split-tunneling between the two VPNs. Note that I don't have to take care of the setup, unless the employer changes the pushed routes. In that case, doing the initial setup again should do the trick.

Please note that some employer's subnet might collide with NordVPN's subnet, but it seems like NordVPN fail-overs to other nodes that doesn't collide, since my employer uses basically 10.0.0.0/8.

---

Here's the shell script that works for me:

#!/bin/bash
set -eo pipefail

function user_can_modify_nordvpn {
    groups | grep -qE "nordvpn|root"
}

echo "First thing to do, is that you need to be disconnected from the NordVPN temporarily."
echo " - the reason is to first establish full connection to your office VPN and fetch all the routes provided by it"
echo " - once we know all the office VPN routes, we will whitelist the involved subnets to NordVPN and start it"
echo " - in that point, both VPNs should work fine - office traffic should be routed through office VPN and everything else through the NordVPN"
echo
read -n 1 -r -p "Now, I need you to prepare for a manual action. I will first disconnect you from NordVPN, so be prepared to spin up your office VPN. Are you ready? (Y/n)"
echo
[[ "$REPLY" =~ ^(Nn)$ ]] && exit 1 || true

if user_can_modify_nordvpn; then
    nordvpn d
else
    sudo nordvpn d
fi

read -n 1 -r -p "NordVPN disconnected. Please spin up your office VPN now. Press any key after you verified successfull connection."

OFFICE_SUBNETS=$(ip route | grep -E "tun|tap" | grep via | awk '{print $1}' | sed 's:^\([^/]\+\)$:\0/32:g' | tee /tmp/office_subnets.txt)

if test "$(echo "$OFFICE_SUBNETS" | wc -l)" -eq 0; then
    echo "ERROR: No 'tun'|'tap' devices found in 'ip route'! So no subnets to add for NordVPN whitelisting." >&2
    exit 1
fi

for subnet in $OFFICE_SUBNETS; do
    if user_can_modify_nordvpn; then
        nordvpn whitelist add subnet "$subnet"
    else
        sudo nordvpn whitelist add subnet "$subnet"
    fi
done

if user_can_modify_nordvpn; then
    nordvpn c
else
    sudo nordvpn c
fi