how to exclude ftp traffic from being routed trough vpn?

Question

I'm using openvpn and the network-manager to connect to ghostvpn and everything's fine, but I want to exclude all ftp traffic from the vpn connection, because I need more speed for up/downloads. Up till now I have to disconnect from the vpn server for the time that I'm doing my up and downloads - that's not a cool solution ;)

How can I do that? Or maybe there's an option in filezilla?

Thanks in advance!

Sebastian

Answer 1

You can route ftp directly to internet with iptables

Here we shall take ftp for routing. Use mangle table of iptables for modifying the ftp packets.

sudo iptables -t mangle -A OUTPUT -p tcp --dport 21 -j MARK --set-mark 0x1

We are marking all packets with destination port 21 as 0x1 .

Now save and restart iptables.

sudo service iptables save
sudo service iptables restart

Next, create a new IP route table in /etc/iproute2/rt_tables by just giving an entry

100 ftptable

Write rule for ftp packets.

ip rule add fwmark 0x1 lookup ftptable

Add route at new table ftptable. All other traffic will go through the vpn if is vpn set like default gateway, which can be seen by ip route show command.

Do this first time when you are connected to vpn.

We copy all entries except default gateway entry from main table.

sudo ip route show table main | grep -Ev ^default | while read ROUTE ; do ip route add table ftptable $ROUTE; done

Add default gateway entry for ftp packets to table ftptable

sudo ip route add default dev <your_interface> table ftptable

your_interfrace in command is you usual wifi or eth interface to access internet when you are not connected to internet.

Use ip route show table ftptable to show all routes at ftptable.

EDIT 1

Second way

Edit /etc/iproute2/rt_tables and add a new table by appending the following line:

100 ftptable

Configure your new routing table named ftptable with a default gateway and create rules to conditionally send traffic to that table.

ip route add default via <usual_gw_ip> dev <your_int> table ftptable
ip rule add fwmark 0x1 table ftptable

Your final annotated script would look like this:

# Populate secondary routing table
ip route add default via <usual_gw_ip> dev <your_int> table ftptable
# Anything with this fwmark will use the secondary routing table
ip rule add fwmark 0x1 table ftptable
# Mark these packets so that iproute can route it through ftptable
iptables -A OUTPUT -t mangle -o <your_int> -p tcp --dport 21 -j MARK --set-mark 1
# now rewrite the src-addr
iptables -A POSTROUTING -t nat -o <your_int> -p tcp --dport 21 -j SNAT --to <your_local_ip>

Try.

EDIT 2

When you are connected to vpn I guess that all traffic go trough them. In you routing table you will see default gw to tun0 interface. Simple add route to route traffic to ftp server to different interface/ip

ip route add <your_ftp_server_ip/32> dev <your_exit_int>

<your_exit_int> - represent not tun interface example: eth0, ens160, ...