I would like to connect to a 3rd party VPN server in Linux (e.g. Debian Jessie) but by default still use my eth0 lan interface as the default route, and am curious how to achieve this. I will be using policy routing or network namespaces or rulesets to select when I want to use the 3rd party VPN.
But it's not clear to me what openvpn is doing behind the scenes that establishes it to direct all traffic through it. To overcome this, is it as simple as overriding "redirect-gateway" when connecting from my client?
Best Answer
Here's a complete solution using control groups (cgroups), which allows per-process resource control. A network control group allows isolating the VPN route, easily allows any process and its children to be selectively run within it, allows non-root users to be granted access to running processes within the cgroup, and using a second instance of dnsmasq can isolate DNS queries as well. This assumes you have openvpn, dnsmasq, cgroup, and version 1.6+ of iptables with cgroup support installed. This was all done on Debian Jessie
The first step is to create the cgroup and setup the iptables accordingly. This should be done on every reboot, so I place the following in /etc/rc.local
The next step is to edit your 3rd party VPN's client configuration file, e.g. /etc/openvpn/client.conf. Leave the rest of your config unchanged.
We now need to create the /etc/openvpn/routeup.sh script
And we now need to create a modified version of update-resolv-conf, which usually comes installed in /etc/openvpn, to create the second instance of dnsmasq. I call it /etc/openvpn/update-dnsmasq-conf
And that should be it. Now you can start your vpn connection and selectively run processes through that interface (the --sticky option ensures that child processes are run in the same cgroup).
NOTE: For dnsmasq, ensure that /etc/resolv.conf points to the localhost (nameserver 127.0.0.1). Your main dnsmasq instance will process queries on your normal non-VPN route and use (/var/run/dnsmasq/resolv.conf) which usually consists of your default gateway or some public DNS (e.g. Google's 8.8.8.8). The second instance is only used by the isolated cgroup