Routing internet traffic through vpn only when connected

Question

I set up a pptp vpn server and can connect to it with my laptop without any problems.

However, connecting to the vpn causes issue with routing (i.e. I am not about to connect to the outside web). To solve this on my laptop (I'm using Ubuntu 14.04), I went into Edit Connections > Wireless > (Network Name) > edit > route and checked the "use this connection only for resources on its network".

This allowed me to connect to the outside web when connected to my vpn, but as soon as I disconnect, I lost access to the outside web until I until I unset the "use this connection only for resources on its network" option.

---

It seems like there must be a better way than manually setting and unsetting this option. Ideally I would like:

connected to vpn: all traffic on my laptop goes through vpn

not connected to vpn: all traffic goes through my whatever network I'm on

Any idea?

Answer 1

To have both VPN and internet, traffic has to be forwarded out of the VPN server’s public network interface. So kindly enable port forwarding by editing the sysctl.conf file. I assume “net.ipv4.ip_forward” is commented in the /etc/sysctl.conf file:

nano /etc/sysctl.conf

Add or find and comment out the following line

net.ipv4.ip_forward=1

Save, close the file and run the following command to make the changes take effect.

sysctl -p

The following iptables firewall rules allow port 1723, GRE and perform NAT

iptables -I INPUT -p tcp --dport 1723 -m state --state NEW -j ACCEPT
iptables -I INPUT -p gre -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

In the last rule replace “eth0″ with the interface connecting to the internet on your VPN server. Finally the following rule is required to ensure websites load properly

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -s 172.20.1.0/24 -j TCPMSS  --clamp-mss-to-pmtu

Replace 172.20.1.0/24 with the IP address range used in the “remoteip” option in the /etc/pptpd.conf this firewall rule is used to ensure a proper MTU value is used to prevent fragmentation.

Hope it could help.