Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I connect to a VPN, all my network traffic is automatically routed through it. Is there a way to add exemptions to that? I don't know if adding exceptions has anything to do with the VPN protocol, but the VPN I'm using is of the OpenVPN protocol.

Speaking of OpenVPN, why is it not installed by default on Ubuntu installs unlike PPTP?

I could not get the list of IRCHighWay's servers, and this is the result I get trying to connect on XChat with running the bash script running:

* Looking up
* Connecting to ( port 6667...
* Connected. Now logging in...
* You have been K-Lined.
* *** You are not welcome on this network.
* *** K-Lined for Open proxies are not allowed. (2011/02/26 01.21)
* *** Your IP is
* *** For assistance, please email and include everything shown here.
* Closing Link: (Open proxies are not allowed. (2011/02/26 01.21))
* Disconnected (Remote host closed socket).

The IP is the one due to my VPN. I had forgotten to check ip route list before running the script, and this is the one after running it:

~$ ip route list dev ppp0  proto kernel  scope link  src via dev eth1  proto static via dev eth1  src dev eth1  proto kernel  scope link  src  metric 2 dev eth1  scope link  metric 1000 
default dev ppp0  proto static

Oh and running the script returned this output:

~$ sudo bash
Usage: inet_route [-vF] del {-host|-net} Target[/prefix] [gw Gw] [metric M] [[dev] If]
       inet_route [-vF] add {-host|-net} Target[/prefix] [gw Gw] [metric M]
                              [netmask N] [mss Mss] [window W] [irtt I]
                              [mod] [dyn] [reinstate] [[dev] If]
       inet_route [-vF] add {-host|-net} Target[/prefix] [metric M] reject
       inet_route [-FC] flush      NOT supported

I ran the script after connecting to the VPN.

share|improve this question
The command that should be run is: route add -host gw – Erik Johansson Feb 28 '11 at 1:00
The problem is that you your routing table didn't look as expected. – Erik Johansson Feb 28 '11 at 1:01
@Erik, that's all?! – Oxwivi Feb 28 '11 at 7:01
@Erik, I mean what about the script and all? – Oxwivi Feb 28 '11 at 7:06
@Erik, IT WORKED! I didn't run the script or anything just running that route command was enough! Do I have to run this every time I boot or is this permanent? the address after gw is not the same for each computer, is it? Can it be replaced by something that that refers to this address? And update your answer, so they may know that running this command, not the script answers the problem. – Oxwivi Feb 28 '11 at 7:19
up vote 6 down vote accepted

Create a file,, that contains:

# script to make connections to go via DEV.
GW=$(ip route list | sed "s/.* via \([0-9.]*\) dev $DEV.*/\1/;t;d"|head -1)
route add -host gw $GW $DEV

Change DEV to be the interface that you get your internet connection from (might be any of wlan0, eth1, eth0, ppp0). Then run the script with sudo bash, you can check the results by running ip route list before and after.

The IP of the default gateway for internet traffic on the DEV device is stored in the variable GW, which is then use to route all traffic going to the server through your default GW instead of the OpenVPN connection you have.

To make this work for all IRCHighWay servers you would have to get a list of all the servers.



# script to make connections to irchighway go via DEV.
GW=$(ip route list | sed "s/.* via \([0-9.]*\) dev $DEV.*/\1/;t;d"|head -1)
cat server_list.txt| xargs -iSERVER route add -host SERVER gw $GW $DEV

There is an "easier" solution, you can mark ports and route based on that, see iproute2 tutorial but I haven't used that. And there are some problems with that kind of routing if you don't know what you are doing.

share|improve this answer
Isn't it possible to let IRC client deal with the servers? I mean when I connect normally it takes care of which server to connect to. – Oxwivi Feb 25 '11 at 10:35
When do I run the script? Before activating VPN or after? And same goes to ip route list. – Oxwivi Feb 25 '11 at 11:15
I updated my question with the result of trying out your script. – Oxwivi Feb 26 '11 at 8:32
yes you can let irc client deal with the servers- – Erik Johansson Feb 28 '11 at 0:57

You can not hinder specific programs to make connections through the VPN, but if they want to reach a specific host or port number then it's possible. I'm going to assume worst case, that you want certain apps to bypass the firewall.

This should be possible to do by using SELinux, by banning network connections from one program. I do not know of any good tools to do this configuration, nor how to change it on the fly.

I think there was once a module in iptables that could match on sending program, but I haven't seen it in a while.

share|improve this answer
I simply want my IRC client to use direct connection since the IRCHighWay network does not allow open proxies. – Oxwivi Feb 21 '11 at 15:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.