Home / ubuntu / Questions / 1130068
In Process
v010dya
Asked: 2019-03-31 22:15:38 +0800 CST

Is it possible to stop using VPN on some application?

  • 772

Currently i am using VPN (done by bitmask) to go only the internet. But i would like to set it up so that two applications access the internet directly. Is there a way to do that?

$ sudo ip6tables --list-rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N bitmask
-A OUTPUT -j bitmask
-A bitmask -d fe80::/64 -o wlp3s0 -j ACCEPT
-A bitmask -d ff05::c/128 -o wlp3s0 -p udp -m udp --dport 1900 -j RETURN
-A bitmask -d ff02::fb/128 -o wlp3s0 -p udp -m udp --dport 5353 -j RETURN
-A bitmask -p tcp -j REJECT --reject-with icmp6-port-unreachable
-A bitmask -p udp -j REJECT --reject-with icmp6-port-unreachable

$ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 303190  bytes 23045786 (23.0 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 303190  bytes 23045786 (23.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.41.0.18  netmask 255.255.248.0  destination 10.41.0.18
        inet6 fe80::7b5f:9d91:701e:c55  prefixlen 64  scopeid 0x20<link>
        inet6 2001:db8:123::1010  prefixlen 64  scopeid 0x0<global>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 2419226  bytes 2916699759 (2.9 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1562458  bytes 208828031 (208.8 MB)
        TX errors 0  dropped 107 overruns 0  carrier 0  collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.147  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::b43f:cba:ab11:d9a8  prefixlen 64  scopeid 0x20<link>
        ether 24:0a:64:da:d6:eb  txqueuelen 1000  (Ethernet)
        RX packets 6908650  bytes 3525833381 (3.5 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 7751152  bytes 7915813822 (7.9 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ iwconfig 
tun0      no wireless extensions.

lo        no wireless extensions.

enp4s0    no wireless extensions.

wlp3s0    IEEE 802.11  ESSID:"ZTE_C5959A"  
          Mode:Managed  Frequency:2.462 GHz  Access Point: FC:2D:5E:C5:95:9A   
          Bit Rate=52 Mb/s   Tx-Power=15 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality=47/70  Signal level=-63 dBm  
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:6  Invalid misc:62   Missed beacon:0
networking vpn

2 Answers

  1. This is possible using network namespaces.

    network namespaces allows separate ip,routing table, socket listing, connection tracking table firewall and other network-related resources.

    At least for VPN solutions like Layer3 SSH, OpenVPN and Wireguard since they are using a virtual interface to route VPN traffic.

    In this simplified example the computer has two interfaces eth0 & eth1 both with DHCP internet access.

    1. Connect to VPN.

    2. in a terminal:
      sudo ip netns add not-vpn # create new network namespace
      sudo ip link set eth1 netns not-vpn # put eth1 in new namespace
      sudo ip netns exec not-vpn bash # enter new namespace with a shell
      dhclient eth1 # get an DHCP IP for the moved interface
      curl icanhazip.com # curl application will return your non-vpn public IP

    3. In a another terminal:
      curl icanhazip.com curl application will return your VPN public IP
      assuming that your VPN is configured to route all traffic through it by default.

    • 2

  2. You can add a route for those two applications so they directly connect to the IP address you want (with wireless card as an interface and your router as a Gateway) and all other traffics go through VPN (add a default route the interface is set to your vpn interface that is shown in ifconfig and set your Gateway to your router and remove the previous one

    You can simply add a new route with this instruction

    PS: After you turn off your VPN because of your new default route you can't access to the internet so your VPN should always be on or you have to write the previous default route that you removed before

    • 0