Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

(Modified for clarity, 11/11/13) Two distinct questions, just before the route table.

I know this has been covered. I've read dozens of posts but still have questions.

I have a work server whose traffic should never leave my house without encryption. The VPN is PPTP. Currently I have a cron job that checks the status of the ppp0 adapter each minute. If the connection drops, which it does fairly often, it shuts key components down.

It's fairly easy to restart PPTP with "nmcli con up id 'myVPNServer'" but there's no assurance it will reconnect and I need a better way to stop traffic (other than killing apps) when ppp0 is down.

The two options I've seen discussed are the firewall (UFW, Firestarter, IPTables) or the route tables. I could be easily swayed to consider the firewall option but I focused on the route tables since no new function needs to be started.

My questions involve the way the route tables change and then specifics on rules.

When I start the PPTP VPN the route tables change. That suggests that if the VPN drops, the table will change back, defeating my stated intent of preventing external traffic. How can I make "sticky" changes to the route table that will persist even if the VPN connection drops? Perhaps the check boxes "Ignore automatically obtained routes" or "Use this connection only for resources on it's network" (which are part of the VPN configuration options)?

It would seem that, if I can force the active VPN route table to stay in effect, even when the VPN drops, that this will effectively kill any external traffic should the VPN drop. This will give me the latitude to run a routine to restart the VPN from the command line (assuming the route table rules don't prevent me re-establishing the connection).

My route table, with the VPN active is (ip route list):

What process is modifying the route table (when I start the VPN)?

Any comments on what 10.10.1.1 is?

$ ip route list
default dev ppp0  proto static 
10.10.1.1 dev ppp0  proto kernel  scope link  src 10.10.1.11 
VPN_Server_IP_Address via 192.168.1.1 dev eth0  proto static 
VPN_Server_IP_Address via 192.168.1.1 dev eth0  src 192.168.1.60 
169.254.0.0/16 dev eth0  scope link  metric 1000 
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.60  metric 1 
share|improve this question

1 Answer 1

Hope the example config can give you an idea to another approach. E.g: execute scripts to do whatever you would like on ppp0 "up\down.." events. You can use the predown script to stop all your services, lockdown all the traffic in the firewall and flush the routing table.

 zcat /usr/share/doc/ifupdown/examples/network-interfaces.gz | less

# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)
##...
# The "pre-up", "up", "down" and "post-down" options are valid for all
# interfaces, and may be specified multiple times. All other options
# may only be specified once.

I assume it is the NetworkManager that is modifying your routing table. The configuration files for the NetworkManager can be found in /etc/NetworkManager/*

Add the following under [ipv4] for your (pptp) connecetion:

ignore-auto-routes=true
ignore-auto-dns=true

I assume you need to restart the pptp connection for it to become active. Worked?

share|improve this answer
    
Thank you but I'm still at a loss... I don't see, in any of those scripts, where they make the changes that I'm seeing in the route tables. The route tables are clearly different with "normal" connectivity and with PPTP active but I can't see where those changes are made. It won't do me any good to change something in the interface scripts if another process is superseding my changes. Any thoughts on what 10.10.1.1 is? –  user212553 Nov 11 '13 at 19:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.