All devices on my network go through my DD-WRT router. Let's say I want one device on my network to bypass the VPN. If I put 192.168.1.100 in the "Policy Based Routing" box on the OpenVPN configuration screen, that IP bypasses the VPN, as it should.
Now, if I add the rule " iptables -I FORWARD -i br0 -o eth0 -j DROP" that will stop all traffic that is non-VPN. That would be fine if I didn't want a few devices to bypass the VPN. If I use that rule, the IP address I add in the "Policy Based Routing" box is blocked.
What rules do I need to set to allow traffic to bypass the VPN and stay up if the VPN drops, but that will also block the other clients on my network if the VPN drops?
"iptables -I FORWARD ! -o tun1 -s IP -j DROP"
I have big question on you.
I have in vpn settings route smtp ips server that is routed by the openvpn.
so my smtp goes around OpenVPN.
Is there any way to add this ip to the exceptions?
pls help, because i think i made a big mistake.
"iptables -I FORWARD ! -o tun0 -j DROP"
"iptables -I FORWARD ! -o tun0 -s 192.168.178.0/24 -j DROP"
thinking this should be the right command to say that my complete network should only use tun0 or nothing.
reading this thread again lets me know, that this is a big mistake? so my complete network is filterd and able to use other routes than tun0???
Hey everyone- found this thread and it's certainly helpful but my setup is slighlty different in that I am leveraging policy based routing to forward only certain devices/ip addresses through the vpn tunnel and the rest of my network bypasses the vpn using my isp.
What would the command look like for this setup?
Then I disconnected the firewall manually and the other IPs remained connected (with the ISP IP).
However i got the solution after reading your problem from vpnranks articles.
I am using the iptables rule suggested in this thread as follows to block traffic not traveling through the VPN.
However, in the case of a power outage or a manual power reset, the time on the router is reset. The VPN cannot connect without the proper time (tls requires the proper time).
Is there a way I can whitelist the call to a ntp.org server so that the timesync on bootup passes successfully? All other non-vpn traffic should remain blocked.