4

I've been working with my Pi running Raspbian lately, and I almost have everything set up as I would like. However, I've been stuck for a bit on my next plan - incorporating a VPN connection.

I have transmission-daemon running, the transmission remote gui running, and a nginx webserver running. I have my VPN running (interface ppp0) and routing all traffic over it, while the remote gui and nginx traffic go over eth0, not to the VPN. Can someone help talk me through the routes I need to add to my routing tables to do that? Here are my route -n outputs:

Before VPN:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

After VPN connected:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 ppp0
10.4.0.1        0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
37.48.66.67     192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
37.48.66.67     192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
Wallace Panter
  • 43
  • 1
  • 3

2 Answers2

1

I once set up vpnc on a RPi to allow for a so called client side split tunnel doing the following. The system is archlinux 3.12.33-1 with vpnc 0.5.3 but I do not see why it should not be working on raspbian. Find a full description (that I followed to the letter) here.

  1. List all the hosts to be accessed via VPN and resolve their IP addresses. This is necessesary as name resolving using DNS might not work properly when establishing the tunnel. Write those IP's and hostnames in /etc/hosts. Keep the list short and include only the hosts that are really needed.
  2. Assuming you have a working vpnc config file, copy it: cp /etc/vpnc/corp.conf /etc/vpnc/split.conf
  3. Edit split.conf to add the line Script /etc/vpnc/vpnc-script-split. This will later on call another script during execution of the config file.
  4. Create the script file /etc/vpnc/vpnc-script-split containing the following (include the IP's gathered in step 1). Note that this needs numeric IP's and does not resolve hostnames:

/etc/vpnc/vpnc-script-split:

#!/bin/sh
# Add one IP to the list of split tunnel
add_ip ()
{
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_ADDR=$1
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_MASK=255.255.255.255
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_MASKLEN=32
    export CISCO_SPLIT_INC=$(($CISCO_SPLIT_INC + 1))
}
# Initialize empty split tunnel list
export CISCO_SPLIT_INC=0

# Delete DNS info provided by VPN server to use internet DNS
# Comment following line to use DNS beyond VPN tunnel
unset INTERNAL_IP4_DNS

# List of IPs beyond VPN tunnel
add_ip 10.0.0.130   # your IP's go here

# Execute default script
. /etc/vpnc/vpnc-script

# End of script
  1. Give the script executable permission chmod 755 /etc/vpnc/vpnc-script-split
  2. Henceforth establish VPN tunnel by calling vpnc split.conf otherwise the standard configuration is used and the split tunnel is not set up.

Credits for the Howto go to Antonio Borneo (see link above). Note that this question could also be asked at Unix.SE as it is not entirely RaspberryPi specific.
Ghanima
  • 15,958
  • 17
  • 65
  • 125
1

One way to have your webserver get routed outside of the VPN is by using the owner match capabilities of iptables.

http://ipset.netfilter.org/iptables-extensions.man.html

owner
This module attempts to match various characteristics of the packet creator, for locally generated packets. This match is only valid in the OUTPUT and POSTROUTING chains. Forwarded packets do not have any socket associated with them. Packets from kernel threads do have a socket, but usually no owner.

[!] --uid-owner username
[!] --uid-owner userid[-userid]
    Matches if the packet socket's file structure (if it has one) is owned by the given user. You may also specify a numerical UID, or an UID range. 
[!] --gid-owner groupname
[!] --gid-owner groupid[-groupid]
    Matches if the packet socket's file structure is owned by the given group. You may also specify a numerical GID, or a GID range. 
[!] --socket-exists
    Matches if the packet is associated with a socket.

So the general idea is that you use iptables mangle to match the packets originating from the nginx UID and mark them.

Then you add a default gateway on a different routing table and use that to route the marked packets.

That new default gateway will use the 192.168.1.1 gateway instead of the VPN gateway.

Of course this is not the only way to accomplish this. You could do this based on the source port of the outgoing packets to match the http traffic of nginx or any other way that suits you. Either way you will need to do packet/connection marking and routing marking to route specific packets via a different gateway.

On MikroTik RouterOS this is a matter of a view clicks. Unfortunately I haven't done this on plain linux before so I haven't got hands on example to provide you with at the moment.

I hope that steers you in the right direction though :)

Cha0s
  • 126
  • 3