Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I'm having a devil of a time getting accurate information on this setup ... searches result in info all over the map.

Anyway, I have a 13.04 Server (CLI only) which has my Comcast cablemodem connected to eth0 and my home LAN connected to eth1. Currently I have the standard NAT setup to get everything out the door to the Internet:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Now, what I want to add is an OpenVPN connection to a 3rd party provider and tunnel ALL Internet traffic through the OpenVPN tunnel. The thrust of this exercise is to avoid any fiddly stuff that Comcast has been known to do (interception of DNS, web caching, who knows what else). The VPN provider's system automagically builds the proper OpenVPN client.conf file for their service:

remote x.x.x.x 500 udp
remote x.x.x.x 123 udp
remote x.x.x.x 53 udp
key-direction 1
cipher AES-256-CBC
dev tun
resolv-retry infinite
verb 4
reneg-sec 86400
echo vpn-dc31 ovpn156
tun-mtu 1500
route-method exe
route-delay 2
redirect-gateway def1
comp-lzo adaptive
explicit-exit-notify 2
fragment 1390
mssfix 1390
hand-window 30
<certificates & keys removed>

I can start the OpenVPN service and the tunnel comes up successfully on tun0:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:  P-t-P:  Mask:

but then I notice I have 2 default routes and I can't ping anything on the Internet neither from the Ubuntu server itself, nor the LAN clients:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface       UG        0 0          0 tun0         <comcast>         UG        0 0          0 eth0 UGH       0 0          0 tun0 UH        0 0          0 tun0
<comcast>   U         0 0          0 eth0       UG        0 0          0 tun0   U         0 0          0 eth1
<ovpn provider> <comcast> UGH       0 0          0 eth0

I'm pretty certain there's some iptables work that needs to be done, and that's what I need help with. The provider is no help, if it's not DD-WRT or Tomato, or a simple Linux client, it's "not supported".

Also, I accept Internet connections on certain ports (like SSH, HTTP, etc.) so I can get into the Ubuntu server remotely, and I want those connections to go through the VPN also. The VPN provider gives me a static IP on their side.

Finally, I want this to all work automatically. If the tunnel goes down, it should re-establish. If I reboot the server, it should all come back up automatically.

Thanks for any help or advice!

share|improve this question

closed as off-topic by Eric Carvalho, karel, Radu Rădeanu, waltinator, BuZZ-dEE May 7 '14 at 22:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

You can to do following.Make script in the folder /etc/network/if-up.d/ called script with execute permissions 755

# Check for specific interface if desired
[ "$IFACE" != "tun0" ] || exit 0
# Adding additional routes on connection
route add default dev tun0 via xxx.xxx.xxx.xxx
route add default dev ethX metric 20
route add ...

This script will add default route to tun0 interface and also add metric to ethX interface. Because is less metric better traffic will go to tun0 int.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.