Fallback routing in OpenVPN

Question

In an effort to be a little environmental friendly I want to setup two connections between my home network and my VPN server.

My VPN server is running Ubuntu 16.04.

The default is my Raspberry Pi box is routing all traffic from my home network to to the VPN server.

However: I want that my desktop computer takes over routing for my network, whenever it is powered on, due to the fact that it can transmit data 10 times faster over VPN than my Raspberry Pi.

It has to fallback to the Rasberry again, when the desktop computer is powered off.

Im sitting on a 300 Mbps connection at home and my VPN server is connected to the Internet via a 10 Gbps connection. ;-)

---

My question is: Can all routing be done from OpenVPN or do I need to make a client connect/disconnect script that fiddle with policy based routing?

Answer 1

Bit of an off-topic answer but... I think you're doing it all wrong.

Don't use a Raspberry Pi for networking.

As you're realising the networking potential of the Raspi is terminally stunted. The ethernet port on a the Raspi3 is only 100mbps. In perfect conditions you can get ~250mbps over USB Ethernet adaptors and the wifi is pretty pap too. Add in all the CPU time for handling encryption and I'd be surprised if you were getting anything near even 30mbps.

OpenVPN is slow and bloated, use WireGuard.

For a point-to-point VPN where you don't have to corral all the hosts into being compatible, use WireGuard. There's a official PPA. It's just a lot faster, and a lot less resource intensive than OpenVPN.

There's only so far I can walk you with this, test it between your desktop and VPN server.

Get a better router that can do all this for you.

Get rid of the Raspi and get a router that supports OpenWRT. We use VDSL2 here so I got a "BT Home Hub 5" with OpenWRT pre-installed for ~£20. They give these things out to new customers so they're artificially cheap and available.

• It uses comparable amounts of power to a Raspi3 (probably less)
• You need a router anyway, you're just replacing your current one (saving more power)
• It's built for gigabit networking throughput.
• You can install Wireguard directly into OpenWRT. It can handle your VPN connection, firewall rules, etc. Forever without any switcheroo.

The hardware you need may vary to mine but don't get pulled into the £300 super-routers that ASUS (et al) make. You can usually spot these a mile off because they look like porcupines with their antennae.

If you need good wifi, buy PoE access points and put them where you actually need them. It's cheaper both initially and when you decide you need 802.11z in two years time.