I have a Ubuntu 14.04.03 router (iptables). Behind it there is a LAN with laptops, tablets, smart TVs, etc.

I would like to use VPN on my TV, but there is no such option in the TVs software/firmware. So I thought that maybe its possible to setup VPN connection on my Ubuntu router and redirect all traffic from TV to this VPN connection. ONLY FROM THE TV. Traffic from other devices, as well as traffic from Ubuntu itself, should use original connection.

Is it possible to do?

My VPN provider is NordVPN. They offer PPTP, L2TP, OpenVPN TCP, OpenVPN UDP and SOCKS5. They provide instructions to setup VPN on Ubuntu at https://nordvpn.com/tutorials/linux/linux-openvpn/, but it doesnt cover what I need ;).

  • There's no easy way to achieve this - your TV isn't designed to do VPN anyways, what's your ultimate reason/goal for this? – Thomas Ward Feb 14 '16 at 15:49
  • On DD-WRT and Tomato routers you can route your traffic via VPN without clients supporting it, knowing about it, so I thought that the same can be achieved on Ubuntu. My goal - I want to bypass my ISP restrictions. – Lux Feb 14 '16 at 18:46

I was looking for the exact same setup. I realize this is a late response but perhaps someone else can benefit from it.

Note: My VPN connection is of type PPP and shows up as the interface ppp0 under ifconfig.

TV: Configure the TV's network settings to use your machine's IP as default gateway.

Ubuntu: Setup IP forwarding and NAT as follows on your machine:

sudo echo 1 > /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o ppp0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i ppp0 -o eth0 -j ACCEPT

I found the following two articles helpful:

From the little reading I've done, I believe the commands above to do the following:

  • Enable IP forwarding in the kernel
  • Instruct the network stack to rewrite the sender address (masquerade) to its own for packages leaving via the ppp0 interface by appending a rule that sets the POSTROUTING chain target of the NAT table to MASQUERADE.
  • Allow packages from eth0 to be routed through ppp0 for certain connection states by setting the FORWARD chain target of the (default) FILTER table to ACCEPT.
  • Allow response packages in all states.
  • But your answer will put all machines in the network to go through the VPN, not just a particular machine (in the question, the TV). – Anthony Wong May 14 '16 at 8:43
  • If they point at that machine as their gateway, yes. but by default they all point at the wifi router and don't even know about that 'via-vpn-router'. – hcvst May 14 '16 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.