Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
configuring openvpn for specific traffic
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
curmudgeon
Veteran
Veteran


Joined: 08 Aug 2003
Posts: 1543

PostPosted: Sun Jun 07, 2015 12:11 pm    Post subject: configuring openvpn for specific traffic Reply with quote

The default openvpn configuration that I received includes a "redirect-gateway" line, which sends ALL of the traffic through the vpn including many types that I don't want to send through it (ntp, for example, but many others, as well).

Is there some way (without building a routing table with hundreds of lines) to send specific traffic through the vpn - I am most interested in http and related (things such as rtmp)., but would like to be able to choose by application (which I don't think is possible).

The man page shows an http-proxy option (which actually isn't an option for me, since the tunnel uses the udp protocol, instead of tcp required for an http proxy), but also a socks-proxy option (which might work).

So, let's suppose that my machine has an ip address of 192.168.0.1, and a tunnel endpoint of 10.0.0.1 (with the remote vpn server at 10.0.0.2). How do I configure openvpn (and what other software do I need to run?) so that I can send only the traffic through the vpn that I want to send through the vpn (with the rest going out through the current gateway)?

Thank you in advance.
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 14159

PostPosted: Sun Jun 07, 2015 3:06 pm    Post subject: Reply with quote

You could use a network namespace to isolate the effects of the VPN. Place the openvpn client in a private network namespace that is routed back out through the host. Run VPN-using applications in that namespace. Run non-VPN applications in the main namespace. Anything in the VPN-using namespace will respect its routes, including the default route. Anything in the main namespace will use your non-VPN routes.
Back to top
View user's profile Send private message
curmudgeon
Veteran
Veteran


Joined: 08 Aug 2003
Posts: 1543

PostPosted: Mon Jun 08, 2015 4:10 am    Post subject: Reply with quote

Hu wrote:
You could use a network namespace to isolate the effects of the VPN.


I have spent most of the day researching this, and it seems like a reasonable idea. Setting up the networking does not seem difficult, but what is the best (simplest) way to run applications in another namespace (on a desktop system)? I didn't find much helpful documentation in that regard.
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 14159

PostPosted: Tue Jun 09, 2015 12:02 am    Post subject: Reply with quote

The simplest way is to use ip netns to manage the network namespaces. That is very low level though, so you might prefer to find or write some wrapper scripts.
Back to top
View user's profile Send private message
steveL
Watchman
Watchman


Joined: 13 Sep 2006
Posts: 5153
Location: The Peanut Gallery

PostPosted: Tue Jun 09, 2015 12:42 pm    Post subject: Reply with quote

IDK if it's relevant, but schorsch_76 wrote a nice tip on bridging VM networks. (Remember: only the bridge interface has an IP address.)

Didn't know about ip netns, thanks Hu.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum