Is it possible to stop using VPN on some application?

Question

Currently i am using VPN (done by bitmask) to go only the internet. But i would like to set it up so that two applications access the internet directly. Is there a way to do that?

$ sudo ip6tables --list-rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N bitmask
-A OUTPUT -j bitmask
-A bitmask -d fe80::/64 -o wlp3s0 -j ACCEPT
-A bitmask -d ff05::c/128 -o wlp3s0 -p udp -m udp --dport 1900 -j RETURN
-A bitmask -d ff02::fb/128 -o wlp3s0 -p udp -m udp --dport 5353 -j RETURN
-A bitmask -p tcp -j REJECT --reject-with icmp6-port-unreachable
-A bitmask -p udp -j REJECT --reject-with icmp6-port-unreachable

$ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 303190  bytes 23045786 (23.0 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 303190  bytes 23045786 (23.0 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.41.0.18  netmask 255.255.248.0  destination 10.41.0.18
        inet6 fe80::7b5f:9d91:701e:c55  prefixlen 64  scopeid 0x20<link>
        inet6 2001:db8:123::1010  prefixlen 64  scopeid 0x0<global>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 2419226  bytes 2916699759 (2.9 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1562458  bytes 208828031 (208.8 MB)
        TX errors 0  dropped 107 overruns 0  carrier 0  collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.147  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::b43f:cba:ab11:d9a8  prefixlen 64  scopeid 0x20<link>
        ether 24:0a:64:da:d6:eb  txqueuelen 1000  (Ethernet)
        RX packets 6908650  bytes 3525833381 (3.5 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 7751152  bytes 7915813822 (7.9 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ iwconfig 
tun0      no wireless extensions.

lo        no wireless extensions.

enp4s0    no wireless extensions.

wlp3s0    IEEE 802.11  ESSID:"ZTE_C5959A"  
          Mode:Managed  Frequency:2.462 GHz  Access Point: FC:2D:5E:C5:95:9A   
          Bit Rate=52 Mb/s   Tx-Power=15 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality=47/70  Signal level=-63 dBm  
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:6  Invalid misc:62   Missed beacon:0

@EODCraftStaff I do not want split tunneling, i wish to have an application that doesn't tunnel through the VPN interface at all. — v010dya, Apr 07 '19 at 04:52

tomodachi · Answer 1 · 2019-04-13T13:52:17.713

3

This is possible using network namespaces.

network namespaces allows separate ip,routing table, socket listing, connection tracking table firewall and other network-related resources.

At least for VPN solutions like Layer3 SSH, OpenVPN and Wireguard since they are using a virtual interface to route VPN traffic.

In this simplified example the computer has two interfaces eth0 & eth1 both with DHCP internet access.

Connect to VPN.
in a terminal:
sudo ip netns add not-vpn # create new network namespace
sudo ip link set eth1 netns not-vpn # put eth1 in new namespace
sudo ip netns exec not-vpn bash # enter new namespace with a shell
dhclient eth1 # get an DHCP IP for the moved interface
curl icanhazip.com # curl application will return your non-vpn public IP
In a another terminal:
curl icanhazip.com curl application will return your VPN public IP
assuming that your VPN is configured to route all traffic through it by default.

edited Apr 13 '19 at 13:52

answered Apr 04 '19 at 00:34

tomodachi

14,832

I assume that eth1 is meant to be the interface i use to connect to the network, i'm using wireless, so i try to substitute it with wlp3s0, however, i get RTNETLINK answers: Invalid argument error. – v010dya Apr 05 '19 at 04:24
If eth1 is wireless in this example iw phy phy0 set netns name not-vpn – tomodachi Apr 05 '19 at 07:24
Doing that completely removed wireless from my machine making it impossible to even connect to a wireless network. – v010dya Apr 05 '19 at 11:23
Let's refine the answer once we get it working.
Could you try attempt to do the opposite? put enp4s0 in the name space while using wifi for VPN. Your enp4s0 needs to be connected to Internet also – tomodachi Apr 05 '19 at 13:22
Ok, i've done what you have in your answer, but with enp4s0 rather than eth1. However when i do dhclient ens0 i get Cannot find device "ens0", and i cannot ping anything even via an ip address. – v010dya Apr 06 '19 at 16:45
1

You should run dhclient enp4s0 , since that's the name of the interface you moved into the namespace – tomodachi Apr 13 '19 at 13:55

score 0 · Answer 2 · answered Apr 07 '19 at 14:14

0

You can add a route for those two applications so they directly connect to the IP address you want (with wireless card as an interface and your router as a Gateway) and all other traffics go through VPN (add a default route the interface is set to your vpn interface that is shown in ifconfig and set your Gateway to your router and remove the previous one

You can simply add a new route with this instruction

PS: After you turn off your VPN because of your new default route you can't access to the internet so your VPN should always be on or you have to write the previous default route that you removed before

answered Apr 07 '19 at 14:14

Afshin

513
2
8
19

1

In those instructions i see how to add routes, but i do not understand how it is relating to make them application specific. – v010dya Apr 07 '19 at 17:27
you have to find out which ip address or addresses those two applications connect , for doing this you can simply run wireshark or tcpdump and when you are running those applications look at destination address and when you find out you can add a new route to that network or specefic host and tell your system when the destination address is these , send data from your wireless card and your router ip address as a Gateway @v010dya – Afshin Apr 08 '19 at 05:20
For testing it , first remove the default route in your routing table and just add routes to destination of those two application , if you are doing in the right way , you should just be able to connect to those applications and nothing else like google etc @v010dya – Afshin Apr 08 '19 at 05:23
The IP addresses that those applications connect to will change all the time. So i guess this approach does not suit me. – v010dya Apr 08 '19 at 05:45
As far as I know it can't have changeable IP address , they just have multi IP address for redundancy purpose and etc , so you can find all of IP addresses of a specific applications by searching (if it is well known app) or asking from support team and write multiple route for an app , but if you say so .. – Afshin Apr 08 '19 at 14:22
The first application is Freenet, the second is a Web browser, both will connect to different IP addresses. I have specifically asked for application based solution and not the IP based one. – v010dya Apr 08 '19 at 17:29

Is it possible to stop using VPN on some application?

2 Answers2

Linked