I'm using openvpn and the network-manager to connect to ghostvpn and everything's fine, but I want to exclude all ftp traffic from the vpn connection, because I need more speed for up/downloads. Up till now I have to disconnect from the vpn server for the time that I'm doing my up and downloads - that's not a cool solution ;)

How can I do that? Or maybe there's an option in filezilla?

Thanks in advance!


  • Some clarification. You want to deny ftp traffic at all when you are on vpn or? – 2707974 Apr 28 '17 at 6:34
  • No, I want the ftp traffic going directly to the internet without using the vpn network. – seppel Apr 28 '17 at 6:42
  • Only ftp? Where you wish to route http? – 2707974 Apr 28 '17 at 6:59
  • its like: if( traffic == ftp) take normal route to internet else: use vpn – seppel Apr 28 '17 at 7:06

You can route ftp directly to internet with iptables

Here we shall take ftp for routing. Use mangle table of iptables for modifying the ftp packets.

sudo iptables -t mangle -A OUTPUT -p tcp --dport 21 -j MARK --set-mark 0x1

We are marking all packets with destination port 21 as 0x1 .

Now save and restart iptables.

sudo service iptables save
sudo service iptables restart

Next, create a new IP route table in /etc/iproute2/rt_tables by just giving an entry

100 ftptable

Write rule for ftp packets.

ip rule add fwmark 0x1 lookup ftptable

Add route at new table ftptable. All other traffic will go through the vpn if is vpn set like default gateway, which can be seen by ip route show command.

Do this first time when you are connected to vpn.

We copy all entries except default gateway entry from main table.

sudo ip route show table main | grep -Ev ^default | while read ROUTE ; do ip route add table ftptable $ROUTE; done

Add default gateway entry for ftp packets to table ftptable

sudo ip route add default dev <your_interface> table ftptable

your_interfrace in command is you usual wifi or eth interface to access internet when you are not connected to internet.

Use ip route show table ftptable to show all routes at ftptable.


Second way

Edit /etc/iproute2/rt_tables and add a new table by appending the following line:

100 ftptable

Configure your new routing table named ftptable with a default gateway and create rules to conditionally send traffic to that table.

ip route add default via <usual_gw_ip> dev <your_int> table ftptable
ip rule add fwmark 0x1 table ftptable

Your final annotated script would look like this:

# Populate secondary routing table
ip route add default via <usual_gw_ip> dev <your_int> table ftptable
# Anything with this fwmark will use the secondary routing table
ip rule add fwmark 0x1 table ftptable
# Mark these packets so that iproute can route it through ftptable
iptables -A OUTPUT -t mangle -o <your_int> -p tcp --dport 21 -j MARK --set-mark 1
# now rewrite the src-addr
iptables -A POSTROUTING -t nat -o <your_int> -p tcp --dport 21 -j SNAT --to <your_local_ip>



When you are connected to vpn I guess that all traffic go trough them. In you routing table you will see default gw to tun0 interface. Simple add route to route traffic to ftp server to different interface/ip

ip route add <your_ftp_server_ip/32> dev <your_exit_int>

<your_exit_int> - represent not tun interface example: eth0, ens160, ...
  • Thanks alot, I will try that later! This looks really promising. – seppel Apr 28 '17 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.