using OpenVPN for specific application(s)
 

Hello everyone,

I am subscribed to unblockvpn.com service and I am using their openvpn but I need to know if I can use this service to be applied to certain application not to the whole internet traffic. Can I?

I hope my question is clear.

Thank you.

You might be able to accomplish this with policy-based routing and split tunneling.

Thank you osor, I googled "policy-based routing" and got some tutorials but I didn't understand what to do with them and it seems to be dangerous I am afraid that if used them I'll corrupt my current internet connectivity. So if you can help me by guiding me through the right commands to apply I'll be thankful.

If I played with those tutorials can I get back my previous configuration? How?

I appreciate your concern.

It depends on the tutorial. You should probably test out non-permanent commands. That way, it all else fails, you can simply reboot and have a pristine routing table.

In terms of specifics steps to take, it isn’t as hard as it sounds. Normally, with openvpn, you use the config option redirect-gateway so that the helper scripts will write the default route to be tun0 (i.e., all traffic routed through the tunnel). Instead, you want selective packets going through.

This is roughly what you would do:

1. Get rid of that option.
2. Start openvpn. You should not be able to access anything through the tunnel.
3. Create a separate routing table called “openvpn” with the commands
   
   Code:

   ---

   echo "100        openvpn" >> /etc/iproute2/rt_tables

   ---

   For this step, make sure that the number 100 isn’t already taken. Also, this step (unlike the others I describe) is permanent. It should not, however, change what a routing table looks like after reboot (unless you already have some conflicting policy routes).
4. Add the default route to openvpn. This depends on how your openvpn server is configured. Here’s a guess (replace 123.123.123.123)
   
   Code:

   ---

   ip route add default via 123.123.123.123 dev tun0 table openvpn

   ---

5. Add a fwmark policy to the route
   
   Code:

   ---

   ip rule add fwmark 42 table openvpn

   ---

   The number 42 is also just chosen to be unique. Hopefully you don’t already have any fwmark-based rules.
6. Use iptables to filter some packets and mark them. This is the most subjective part. Basically, you will need some way to match those packets you want tunneled. For example, you might create a user named tunnel_me. Then, use a rule like the following:
   Code:

   ---

   iptables -t mangle -A OUTPUT -m owner --uid-owner tunnel_me -j MARK --set-mark 42

   ---

   and any program that tunnel_me runs will have tunneling applied.
7. See if it works. If so, automate it so it works all the time.

osor I am truly sorry I could not reply because I faced some issues with my laptop but here what I tried after I connected to the service with commenting out "redirect-gateway" from the file I got from unblockVPN.com:

The Steps I did:
But it seems to have no effects, so I appended the file I got from their website:

file: unblockvpn.ovpn
output of openvpn with the configuration taken from unblockvpn.ovpn
I forgot to mention that the user tunnel_me is already created.
So please guide me to figure out what I missed.

Thank you again.

please can any one help me?

You have to be more specific. Do you mean that all the traffic is flowing through the tunnel? Or none of it? You also have to some information about routing tables before and after running. For example, what does your pristine routing table look like (before running openvpn or executing any of those commands I told you about). It would be the output of “ip route” (although the route command also works).
You seem to have forgotten the “table” specifier.
In my experience, tap devices have been hard to firewall. You would be better off setting this to tun.
This has not been commented out as you described.
It seems you have been given the tunnel address 77.78.108.254/25 with the default route 77.78.108.129. This is added to the main routing table, so I expect that all traffic is going through the tunnel. You will either need to stop/modify the openvpn scripts from doing this (if commenting out the default route didn’t work) or write some sort of a wrapper script which saves and restores the default route. This would also be handy if the new gateway address always changes (so you can relocate step 4 to this script). Code for the script might look something like:

Btw, I did not say so explicitly, but step 3 should not be performed more than once (even after rebooting), since you are writing to a persistent file (namely /etc/iprotue2/rt_tables). Technically, you don’t need to do this, but it makes life easier to talk about the “openvpn” table rather than to “100” table. So make sure (in a text editor) that this file has only one line equating 100 and openvpn.

I meant by "no effects" that there are no traffic go through the tunnel, it acts like if I didn't run openvpn.

I didn't forget but I copied the wrong command, sorry my bad.

Yes I already commented out "redirect-gateway" when I did those steps but I appended the original file - which has that line uncommented -. The first step, which is I only applied it once even after rebooting I didn't apply it. Also there is only one line with 100 in /etc/iproute2/rt_tables.

I'll show the routing table before and after running openvpn.

Before running openvpn:

After running openvpn with commenting out "redirect-gateway":
from this table I see that openvpn created a default route for tap0 device but it didn't affect eth1 device witch is only connected to internet. So how to make tap0 speak to eth1?


After running openvpn without commenting out "redirect-gateway":
The $save and $new in the script you supplied are the same without running openvpn or running it with commenting out "redirect-gateway", so they may not help but they differ when running openvpn without commenting out.

in the first 2 cases - which are without running openvpn or running it with commenting out "redirect-gateway" - the result of
is
but with the third case -running openvpn without commenting out- the result is

Thank you for your kindness and patience.

can any one help?

Common netiquette dictates that when bumping your own thread, indicate some details about what you have done in the meanwhile. You have two posts that are 35.25 hours apart, yet you have not detailed any further experimentation possibly performed in this time frame! For example, have you tried using the TUN driver (rather than TAP)? Have you tried saving and restoring the route when using the uncommented config file?

From all I can see, it should be working correctly, unless I am missing something simple. You can always try further experimentation, such as blackholing the openvpn table to make sure that tunnel_me’s traffic actually flows through it, or adding some logging rules to iptables. If you can’t get it to work, you can always try virtualization, though in this case, it seems like overkill.