Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to use VPN just for some part of the system? This means that, for example, Firefox and aria2c will use the vpn and pidgin won't! Is it possible?

In my case, I want to use VPN for whole system except: transmission, apt-get and pidgin or vice versa: Just using vpn for these software: firefox, aria2c, youtube-dl

share|improve this question
As long as the software doesn't make any UDP queries, you should be able to just socksify it. Am I missing something? – RobotHumans Aug 8 '13 at 22:42
Assuming that there's no socks server available (or ssh server) on the route path that the user wants to use per progam. Which means that routing of that "local" socks server has to be handled somehow. – Manwe Aug 9 '13 at 12:27
That's a really serious corner case. Valid I guess, but seriously corner case. – RobotHumans Aug 9 '13 at 19:53

@see superuser question about different interfaces for different processes

This answer requires some compiling (see above for more), root access and ip command from iproute package

sudo apt-get install iproute

This will retrieve and compile PRELOAD library in your current directory.

wget -O bind.c
gcc -nostartfiles -fpic -shared bind.c -o -ldl -D_GNU_SOURCE

Now, let's assume that your VPN is online and you know your tunnel device name (like tun0). Let's also assume that you know your default gw (route |awk '/default/ {print $2 }') And your tunnel/other device gateway route |awk '/tun0/ {print $2 }'

## run as root:
## which device to route out with (tun0, eth0, wlan0) 
export DEV=tun0
## default gw to use for that device (see above for advice)
export DEVGW=
# which routing table to use
export TABLE=special_table1
# get ip for "$DEV"
export BINDIP=$(ifconfig $DEV | perl -ne 'if (/inet addr:([\d\.]+)/) {print $1}')

## create empty routing tables
# match name to TABLE variable above with unique number before it.
# like: (creates two tables)
echo 201 special_table1 >> /etc/iproute2/rt_tables
echo 202 special_table2 >> /etc/iproute2/rt_tables

## add default gw for special routing table
ip route add default via $DEVGW dev $DEV table $TABLE
## source route all traffice from you bound ip through that
ip rule add from $BINDIP table $TABLE

# flush routing cache
ip route flush cache

To look at your routing tables:

# This is the main table (should basically have same info as `route -n`)
ip route show table main
# your special_table1
ip route show table special_table1

# this this you can see which source ips trigger which routing table
ip rule show

Running a program like firefox with PRELOADED and binding it to the interface you want to route out traffic with.

### run as user 
## change DEV to with route/device you want your program to bind to 
export DEV=tun0
export BINDIP=$(ifconfig $DEV | perl -ne 'if (/inet addr:([\d\.]+)/) {print $1}')


If you want you can repeat this for as many interfaces you want and you so that the specific application is bound to specific interface. All applications not started with route out as your main routing table specifies.

share|improve this answer

If you can determine the specific IP addresses and/or ports that you want to use with VPN or vice versa, then the ip command will help you do that by allowing/disallowing a route for such and such.

The ip command is found in the iproute package:

sudo apt-get install iproute
man ip

I've been using it in a very limited fashion so I do not want to give you detailed information, but I'm pretty sure you can figure it out with the documentation. You may also find good example online on how to do such things with the ip command.

share|improve this answer

It is possible to configure a listening socket (i.e. a program that offers a service) to use a specific adapter. But client programs such as Firefox will usually simply send IP packets to the OS (by binding to and leave it up to the OS as to how those packets reach the internet.

Some client programs do allow you to configure binding to a specific adapter IP address, but how to do this is down to each applications configuration.

It is possible to configure IPTABLES2 to use the PID (process ID) to route IP to a given adapter, but this PID will keep changing so would require the firewall rules to be continuously updated.

A better solution is to install a simple SOCKS proxy, such as Squid (which is rather complicated), tinyproxy, Dante or SS5.

Bind the proxy server to offer SOCKS5 on the lo adapter and configure it to send all IP via the VPN adapter.

If you bind the proxy server to an Ethernet port, other machines in the same network can use the same SOCKS server.

Configure each app that needs to use the VPN to use the proxy server.

There are tools such as soxify and tsocks that can be used to force programs that don't natively support SOCKS to use it.

share|improve this answer

If you want to use the vpn to route your trafic trough it, and you want for example to use it with firefox for example this is what you do: You enter Firefox, go to Options menu: enter image description here

Go to Advance -> Network Tab

enter image description here

Now in the Connection Settings dialog:

Select Manual configuration
In SOCKS Host, enter your loopback ip address (always
Use the port you chose above (80, or 8080 or whatever if you don’t want to use 80)
Make sure SOCKS v5 is chosen
If you don’t want to proxy some addresses (maybe localhost or something) enter those
addresses\domains in the “No Proxy for:” text box
Click OK.

enter image description here

And you should be good to go. You can check your ip to see if it is working corectly.
The procedure should be the same for the rest of the applications. Note that not all have these options.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.