I'm trying to follow this guide from TinC on how to forward all webtraffic through a VPN tunnel to a safe internet connection.  Typical unsecure coffee shop connection type problem.Anyway, I'm using TinC, and I can connect to the server no problem, but I'm not routing any internet traffic through this connection.  I'm sure of this because my public IP is still different from the IP I would expect back at the safe side of the VPN.Here's the setup that connects, but has no interet traffic for tinc-up:ip link set $INTERFACE upip addr add  10.0.0.3/32 dev $INTERFACEip route add 10.0.0.0/24 dev $INTERFACEAnd here's tinc-down:ip route del 10.0.0.0/24 dev $INTERFACEip addr del 10.0.0.3/32 dev $INTERFACEip link set $INTERFACE downAnd here's the client host file:Subnet = 10.0.0.3/32And here's the server host file:Address = foo.bar.netPort = 655Subnet = 10.0.0.1/32....So, that's all well and good...Here's some sample output:foo@local:~  route -nKernel IP routing table                                                                               Destination     Gateway         Genmask         Flags Metric Ref    Use Iface                         0.0.0.0         192.168.0.254   0.0.0.0         UG    202    0        0 enp0s3                        10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 alpha                         192.168.0.0     0.0.0.0         255.255.255.0   U     202    0        0 enp0s3   But, I try following this guide here:  https://www.tinc-vpn.org/examples/redirect-gateway/new tinc-up:set -xip link set dev $INTERFACE up#ip addr add  10.0.0.3/32 dev $INTERFACE#ip route add 10.0.0.0/24 dev $INTERFACEVPN_GATEWAY=10.0.0.0ORIGINAL_GATEWAY=`ip route show | grep ^default | cut -d ' ' -f 2-5`ip route add $REMOTEADDRESS $ORIGINAL_GATEWAYip route add $VPN_GATEWAY dev $INTERFACEip route add 0.0.0.0/1 via $VPN_GATEWAY dev $INTERFACEip route add 128.0.0.0/1 via $VPN_GATEWAY dev $INTERFACEnew tinc-down:set -xORIGINAL_GATEWAY=`ip route show | grep ^default | cut -d ' ' -f 2-5`ip route del $REMOTEADDRESS $ORIGINAL_GATEWAYip route del $VPN_GATEWAY dev $INTERFACEip route del 0.0.0.0/1 dev $INTERFACEip route del 128.0.0.0/1 dev $INTERFACEip link set dev $INTERFACE downAnd the scripts now throw syntax errors for ip route and of course, nothing happens.  I've tried playing with some of the routes, I've tried explicitly defining some variables, and I've even tried running these step by step in a shell, but nothing seems to work.  The host is always unreachable.What am I doing wrong here?ThanksEDIT 2:Here is the new tinc-up/down files being run with suggestions from the comments including the set-x option.  This follows a running of the tinc-up script followed by a killing of the process, which initiates the tinc-down script shown above.:~  sudo tincd -n alpha -D -d3 tincd 1.0.31 starting, debug level 3/dev/net/tun is a Linux tun/tap device (tun mode)Executing script tinc-up+ ip link set dev alpha up+ VPN_GATEWAY=10.0.0.0++ ip route show++ cut -d ' ' -f 2-5++ grep '^default'+ ORIGINAL_GATEWAY='via 192.168.0.254 dev enp0s3'+ ip route add via 192.168.0.254 dev enp0s3Usage: ip route { list | flush } SELECTOR       ip route save SELECTOR       ip route restore       ip route showdump       ip route get ADDRESS [ from ADDRESS iif STRING ]                            [ oif STRING ] [ tos TOS ]                            [ mark NUMBER ] [ vrf NAME ]                            [ uid NUMBER ]       ip route { add | del | change | append | replace } ROUTESELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ]            [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ]            [ type TYPE ] [ scope SCOPE ]ROUTE := NODE_SPEC [ INFO_SPEC ]NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ]             [ table TABLE_ID ] [ proto RTPROTO ]             [ scope SCOPE ] [ metric METRIC ]INFO_SPEC := NH OPTIONS FLAGS [ nexthop NH ]...NH := [ encap ENCAPTYPE ENCAPHDR ] [ via [ FAMILY ] ADDRESS ]        [ dev STRING ] [ weight NUMBER ] NHFLAGSFAMILY := [ inet | inet6 | ipx | dnet | mpls | bridge | link ]OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ as [ to ] ADDRESS ]           [ rtt TIME ] [ rttvar TIME ] [ reordering NUMBER ]           [ window NUMBER ] [ cwnd NUMBER ] [ initcwnd NUMBER ]           [ ssthresh NUMBER ] [ realms REALM ] [ src ADDRESS ]           [ rto_min TIME ] [ hoplimit NUMBER ] [ initrwnd NUMBER ]           [ features FEATURES ] [ quickack BOOL ] [ congctl NAME ]           [ pref PREF ] [ expires TIME ]TYPE := { unicast | local | broadcast | multicast | throw |          unreachable | prohibit | blackhole | nat }TABLE_ID := [ local | main | default | all | NUMBER ]SCOPE := [ host | link | global | NUMBER ]NHFLAGS := [ onlink | pervasive ]RTPROTO := [ kernel | boot | static | NUMBER ]PREF := [ low | medium | high ]TIME := NUMBER[s|ms]BOOL := [1|0]FEATURES := ecnENCAPTYPE := [ mpls | ip | ip6 ]ENCAPHDR := [ MPLSLABEL ]+ ip route add 10.0.0.0 dev alpha+ ip route add 0.0.0.0/1 via 10.0.0.0 dev alpha+ ip route add 128.0.0.0/1 via 10.0.0.0 dev alphaListening on 0.0.0.0 port 655ReadyTrying to connect to alpha (74.78.156.164 port 655)Error while connecting to alpha (74.78.156.164 port 655): Network is unreachableCould not set up a meta connection to alphaTrying to re-establish outgoing connection in 5 secondsPurging unreachable nodesTrying to connect to alpha (74.78.156.164 port 655)Error while connecting to alpha (74.78.156.164 port 655): Network is unreachableCould not set up a meta connection to alphaTrying to re-establish outgoing connection in 10 secondsPurging unreachable nodesGot TERM signalStatistics for Linux tun/tap device (tun mode) /dev/net/tun: total bytes in:         346 total bytes out:        306Closing connection with charlie (MYSELF)Executing script tinc-down++ cut -d ' ' -f 2-5++ grep '^default'++ ip route show+ ORIGINAL_GATEWAY='via 192.168.0.254 dev enp0s3'+ ip route del via 192.168.0.254 dev enp0s3Usage: ip route { list | flush } SELECTOR       ip route save SELECTOR       ip route restore       ip route showdump       ip route get ADDRESS [ from ADDRESS iif STRING ]                            [ oif STRING ] [ tos TOS ]                            [ mark NUMBER ] [ vrf NAME ]                            [ uid NUMBER ]       ip route { add | del | change | append | replace } ROUTESELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ]            [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ]            [ type TYPE ] [ scope SCOPE ]ROUTE := NODE_SPEC [ INFO_SPEC ]NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ]             [ table TABLE_ID ] [ proto RTPROTO ]             [ scope SCOPE ] [ metric METRIC ]INFO_SPEC := NH OPTIONS FLAGS [ nexthop NH ]...NH := [ encap ENCAPTYPE ENCAPHDR ] [ via [ FAMILY ] ADDRESS ]        [ dev STRING ] [ weight NUMBER ] NHFLAGSFAMILY := [ inet | inet6 | ipx | dnet | mpls | bridge | link ]OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ as [ to ] ADDRESS ]           [ rtt TIME ] [ rttvar TIME ] [ reordering NUMBER ]           [ window NUMBER ] [ cwnd NUMBER ] [ initcwnd NUMBER ]           [ ssthresh NUMBER ] [ realms REALM ] [ src ADDRESS ]           [ rto_min TIME ] [ hoplimit NUMBER ] [ initrwnd NUMBER ]           [ features FEATURES ] [ quickack BOOL ] [ congctl NAME ]           [ pref PREF ] [ expires TIME ]TYPE := { unicast | local | broadcast | multicast | throw |          unreachable | prohibit | blackhole | nat }TABLE_ID := [ local | main | default | all | NUMBER ]SCOPE := [ host | link | global | NUMBER ]NHFLAGS := [ onlink | pervasive ]RTPROTO := [ kernel | boot | static | NUMBER ]PREF := [ low | medium | high ]TIME := NUMBER[s|ms]BOOL := [1|0]FEATURES := ecnENCAPTYPE := [ mpls | ip | ip6 ]ENCAPHDR := [ MPLSLABEL ]+ ip route del dev alphaUsage: ip route { list | flush } SELECTOR       ip route save SELECTOR       ip route restore       ip route showdump       ip route get ADDRESS [ from ADDRESS iif STRING ]                            [ oif STRING ] [ tos TOS ]                            [ mark NUMBER ] [ vrf NAME ]                            [ uid NUMBER ]       ip route { add | del | change | append | replace } ROUTESELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ]            [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ]            [ type TYPE ] [ scope SCOPE ]ROUTE := NODE_SPEC [ INFO_SPEC ]NODE_SPEC := [ TYPE ] PREFIX [ tos TOS ]             [ table TABLE_ID ] [ proto RTPROTO ]             [ scope SCOPE ] [ metric METRIC ]INFO_SPEC := NH OPTIONS FLAGS [ nexthop NH ]...NH := [ encap ENCAPTYPE ENCAPHDR ] [ via [ FAMILY ] ADDRESS ]        [ dev STRING ] [ weight NUMBER ] NHFLAGSFAMILY := [ inet | inet6 | ipx | dnet | mpls | bridge | link ]OPTIONS := FLAGS [ mtu NUMBER ] [ advmss NUMBER ] [ as [ to ] ADDRESS ]           [ rtt TIME ] [ rttvar TIME ] [ reordering NUMBER ]           [ window NUMBER ] [ cwnd NUMBER ] [ initcwnd NUMBER ]           [ ssthresh NUMBER ] [ realms REALM ] [ src ADDRESS ]           [ rto_min TIME ] [ hoplimit NUMBER ] [ initrwnd NUMBER ]           [ features FEATURES ] [ quickack BOOL ] [ congctl NAME ]           [ pref PREF ] [ expires TIME ]TYPE := { unicast | local | broadcast | multicast | throw |          unreachable | prohibit | blackhole | nat }TABLE_ID := [ local | main | default | all | NUMBER ]SCOPE := [ host | link | global | NUMBER ]NHFLAGS := [ onlink | pervasive ]RTPROTO := [ kernel | boot | static | NUMBER ]PREF := [ low | medium | high ]TIME := NUMBER[s|ms]BOOL := [1|0]FEATURES := ecnENCAPTYPE := [ mpls | ip | ip6 ]ENCAPHDR := [ MPLSLABEL ]+ ip route del 0.0.0.0/1 dev alpha+ ip route del 128.0.0.0/1 dev alpha+ ip link set dev alpha downTerminatingEDIT 3:I find that changing to: ORIGINAL_GATEWAY=`ip route show | grep ^default | cut -d ' ' -f 3-5` gives 192.168.0.254 dev enp0s3and now my scripts don't throw syntax errors for iproute...However, they do complain about the following:+ ip route add 192.168.0.254 dev enp0s3RTNETLINK answers: File exists 
How to forward web traffic with iproute
networking;vpn