Split tunneling

From James's Wiki
Revision as of 22:16, 3 March 2022 by Ractive (talk | contribs)

setup openvpn

create systemd service file for openvpn

sudo nano /etc/systemd/system/openvpn@openvpn.service 

 [Unit]
 Description=OpenVPN connection to %i
 Documentation=man:openvpn(8)
 Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
 Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
 After=network.target
 
 [Service]
 RuntimeDirectory=openvpn
 PrivateTmp=true
 KillMode=mixed
 Type=forking
 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
 PIDFile=/run/openvpn/%i.pid
 ExecReload=/bin/kill -HUP $MAINPID
 WorkingDirectory=/etc/openvpn
 Restart=on-failure
 RestartSec=3
 ProtectSystem=yes
 LimitNPROC=10
 DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw
 
 [Install]
 WantedBy=multi-user.target

make sure the following are installed: 

apt-get install nano sudo apt-utils iptables curl resolvconf unzip


Configure VPN DNS Servers to Stop DNS Leaks

Next we are going to prevent DNS leak. DNS Leaks are often the main reason your real identity gets exposed even if using VPN. You can read more about DNS leaks here and test them here. The update-resolv-conf script that comes with OpenVPN will automatically apply the preferred DNS servers when OpenVPN connects.

This script will make sure that when using OpenVPN you are not subject to DNS leaks. We will use PIA's DNS Servers (209.222.18.222 and 209.222.18.218) and Google's (8.8.8.8) as a third option. You are free to use the DNS servers you trust and prefer. It is advised to change the local DNS to a public even if you are not using VPN. If you are behind a router (and you probably are), it is also a good practice to configure public DNS address on the router too.

Note: make sure you are using a static IP on your machine or reserved DHCP also known as static DHCP. Do not configure the static IP on your server, as resolvconf will not work then. You should set the static IP from your router!

Open the update-resolv-conf file 

sudo nano /etc/openvpn/update-resolv-conf

Locate this part 

# foreign_option_1='dhcp-option DNS 193.43.27.132'
# foreign_option_2='dhcp-option DNS 193.43.27.133'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'

Replace the part highlighted in red, make sure you uncomment (remove the # from beginning) these 3 lines, and pay attention to the third line where your need to replace DOMAIN with DNS.

It should look exactly like this 

foreign_option_1='dhcp-option DNS 208.67.222.222'
foreign_option_2='dhcp-option DNS 208.67.220.220'
foreign_option_3='dhcp-option DNS 8.8.8.8'

Hit Ctrl+X, Y and Enter to Save.

Your DNS is configured for OpenVPN to prevent DNS leaks.

Split Tunneling with iptables and Routing Tables

We will use iptables to mark packets from a user (in our case the vpn user), and then use routing tables to route these marked packets through the OpenVPN interface, while allowing unmarked packets direct access to the Internet.

Create vpn User Create the user vpn. All of the applications you want tunneled over VPN will run as this user, especially your torrent client of choice (Transmission or Deluge). At the end of this guide you will see the links to our guides on how to configure Transmission and Deluge with Split Tunneling.

Create vpn user with no login option 

sudo adduser --disabled-login vpn

I suggest to leave personal details blank, just proceed with Enter, and finally answer Y to create vpn user. We disabled login for the vpn user for security reasons, there is no need to log in to the system as the vpn user.

We are going to use the vpn user to run services (like Torrent client), it is recommended to add your regular user to the vpn group and vpn user to your regular user's group to avoid any permission issues.

Replace username with the user you would like to add to the vpn group 

sudo usermod -aG vpn username

Replace group with the group name of your regular user that you would like to add the vpn user to 

sudo usermod -aG group vpn

he iptables Script We need the local IP and the name of the network interface. Again, make sure you are using a static IP on your machine or reserved DHCP also known as static DHCP, but configured on your router!

ip route list The output will be similar to this

default via 192.168.1.1 dev eth0 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.110 eth0 is the network interface (NETIF), and 192.168.1.110 is the local IP address (LOCALIP). You will need to enter these two into the following script, which we are going to create now.

UPDATE (8 November 2016): thanks to a feedback by our member Jesus, we are now addressing a vulnerability related to the VPN Split Tunnel implementation. If the PIA login credentials are not correct, then OpenVPN will not establish the VPN connection, therefore the firewall rules are not applied (since OpenVPN will execute up scripts only on successful connection). The result is not having the kill switch enabled (iptables rules loaded) and vpn user has direct access to Internet. To prevent this scenario, we will implement a permanent firewall rule to block vpn user’s access to Internet until the OpenVPN tunnel is up and functional, and the required scripts are started. This will prevent any IP leaks even if no connection to PIA is possible for any reason.

Flush current iptables rules

sudo iptables -F Add the following rule, which will block vpn user's access to Internet (except the loopback device). Note, if you configured Split Tunnel with different user then vpn, then change vpn marked in red to the user you used.

sudo iptables -A OUTPUT ! -o lo -m owner --uid-owner vpn -j DROP Now install iptables-persistent to save this single rule that will be always applied on each system start.

sudo apt-get install iptables-persistent -y During the install, iptables-persistent will ask you to save current iptables rules to /etc/iptables/rules.v4 as seen on the screenshot, accept this with YES

iptables_persistent_split_tunnel-min

Now when system starts, vpn user is not able to access Internet. If the OpenVPN service is started successfully, then this rule is flushed (only until the next system restart), and the Split Tunnel rules are applied.

iptables Script for vpn User The first script will mark the packets for vpn user, the second script will take care of proper routing.

Create the iptables script

sudo nano /etc/openvpn/iptables.sh Copy the following to the iptables.sh script, and make sure you enter the network interface and the local IP we identified and marked with red and blue respectively.

You can see the comments for each section about the function of the given part of the script. If you are interested in more details about iptables, a good starting point is the Official Ubuntu Documentation.

Remember, this script will flush your existing iptables rules (UFW included), therefore you need to append your own rules into this script if you need any additional firewall rules.

  1. ! /bin/bash
  2. Niftiest Software – www.niftiestsoftware.com
  3. Modified version by HTPC Guides – www.htpcguides.com

export INTERFACE="tun0" export VPNUSER="vpn" export LOCALIP="192.168.1.110" export NETIF="eth0"

  1. flushes all the iptables rules, if you have other rules to use then add them into the script

iptables -F -t nat iptables -F -t mangle iptables -F -t filter

  1. mark packets from $VPNUSER

iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark iptables -t mangle -A OUTPUT ! --dest $LOCALIP -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1 iptables -t mangle -A OUTPUT --dest $LOCALIP -p udp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1 iptables -t mangle -A OUTPUT --dest $LOCALIP -p tcp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1 iptables -t mangle -A OUTPUT ! --src $LOCALIP -j MARK --set-mark 0x1 iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

  1. allow responses

iptables -A INPUT -i $INTERFACE -m conntrack --ctstate ESTABLISHED -j ACCEPT

  1. block everything incoming on $INTERFACE to prevent accidental exposing of ports

iptables -A INPUT -i $INTERFACE -j REJECT

  1. let $VPNUSER access lo and $INTERFACE

iptables -A OUTPUT -o lo -m owner --uid-owner $VPNUSER -j ACCEPT iptables -A OUTPUT -o $INTERFACE -m owner --uid-owner $VPNUSER -j ACCEPT

  1. all packets on $INTERFACE needs to be masqueraded

iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE

  1. reject connections from predator IP going over $NETIF

iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT

  1. Start routing script

/etc/openvpn/routing.sh

exit 0 Hit Ctrl+X, Y and Enter to save and exit.

Make the iptables script executable

sudo chmod +x /etc/openvpn/iptables.sh Routing Rules Script for the Marked Packets With the routing rules we configure the route for the packets we just marked with the first script. You can read more about the routing tables at the following link.

Create the routing script

sudo nano /etc/openvpn/routing.sh Paste the following script which makes the default route after the VPN the loopback interface, effectively nulling the traffic if the VPN connection goes down.

  1. ! /bin/bash
  2. Niftiest Software – www.niftiestsoftware.com
  3. Modified version by HTPC Guides – www.htpcguides.com

VPNIF="tun0" VPNUSER="vpn" GATEWAYIP=$(ifconfig $VPNIF | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | egrep -v '255|(127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | tail -n1) if grep -c 0x1` == 0 ; then ip rule add from all fwmark 0x1 lookup $VPNUSER fi ip route replace default via $GATEWAYIP table $VPNUSER ip route append default via 127.0.0.1 dev lo table $VPNUSER ip route flush cache

  1. run update-resolv-conf script to set VPN DNS

/etc/openvpn/update-resolv-conf

exit 0 Hit Ctrl+X, Y and Enter to Save and Exit.

Finally, make the script executable

sudo chmod +x /etc/openvpn/routing.sh Configure Split Tunnel VPN Routing We will need a routing table by adding the table name to the rt_tables file (in our case it is vpn). Open rt_tables

sudo nano /etc/iproute2/rt_tables Add the vpn user table at the bottom of the file

200 vpn It should look similar to this:

  2. reserved values

255 local 254 main 253 default 0 unspec

  2. local
  4. 1 inr.ruhep

200 vpn Hit Ctrl + X, Y and Enter to save and exit.

Change Reverse Path Filtering Finally, we need to change the default level of reverse path filtering to ensure the kernel routes the traffic correctly. By default it is set to value of 1 that is “strict mode”. It is not necessary to disable reverse path filtering completely (setting to “0”), but we need to set it to level 2, “loose mode”.

Create a reverse path filter file for the vpn user

sudo nano /etc/sysctl.d/9999-vpn.conf Copy the following, make sure you use the correct network interface name in the third line marked with red (remember the ip route list command from before and the output, in our case it was eth0)

net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.eth0.rp_filter = 2 Hit Ctrl + X, Y and Enter to save and exit.

To apply new sysctl rules run:

sudo sysctl --system Testing the VPN Split Tunnel I recommend a system restart, and if everything was configured properly, you should have a running OpenVPN service enabled for the vpn user and all the other users on your server should have direct access to Internet. Now lets check if everything is correct.

Test OpenVPN service Login as your regular user over SSH, and check OpenVPN service status

sudo systemctl status openvpn@openvpn.service This should return something like this

openvpn@openvpn.service - OpenVPN connection to client 

Loaded: loaded (/etc/systemd/system/openvpn@openvpn.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2016-09-05 11:25:18 CEST; 1 day 4h ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 3223 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn
Main PID: 3266 (openvpn)
CGroup: /system.slice/system-openvpn.slice/openvpn@openvpn.service
└─3266 /usr/sbin/openvpn --daemon ovpn-client --status /run/openvpn/client.status 10 --cd /etc/openvpn

Sep 05 11:25:21 server ovpn-client[3266]: OPTIONS IMPORT: route options modified Sep 05 11:25:21 server ovpn-client[3266]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Systemd gives a very nice overview about the service state. In the above example you can see that the service is Active (running), just as we need.

If the service is not running you can check if there is a log of the error in /var/log/syslog . For troubleshooting you can set output verbosity in the openvpn.conf file to a higher level. Set it to 3 and check the syslog again. You can always ask for help in the forum section. Remember to set verbosity level back to 1 if you don't need more detailed logs anymore.

Check IP address Using the SSH session for the regular user, check the IP address

curl ipinfo.io It will return your IP and depending on how much information is provided, the country should be listed in each case. Obviously, it should be your ISP now and your location.

Now check the IP address of the vpn user with

sudo -u vpn -i -- curl ipinfo.io If everything went fine, it should return the IP address and the country of the VPN server you selected. If you used Sweden server, then the country should be “SE”. It is very important that the IP address for user vpn should be different then your regular user's IP.

In my case for user vpn and using Sweden PIA server I have the following output

{ 

 "ip": "X.XXX.XXX.XX",
 "hostname": "No Hostname",
 "city": "",
 "region": "",
 "country": "SE",
 "loc": "59.3294,18.0686",
 "org": "AS57858 Inter Connects Inc"

Obviously, the “x.xxx.xxx.xx” part is my assigned VPN IP address which is different then my public IP, and you can see the country as SE which is Sweden.

Check DNS Server Finally, check if the DNS for VPN is properly configured, type

sudo -u vpn -i -- cat /etc/resolv.conf The output should be

  1. Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
  2. DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

nameserver 209.222.18.222 nameserver 209.222.18.218 nameserver 8.8.8.8 If you see the above DNS servers then your DNS for VPN is configured correctly.

UPDATE (July 15 2019): How to Configure with Static IP Many users reported problems using Split Tunnel when using static IP configured on Ubuntu Server 16.04 or Debian 8. I did some testing, and for static IP systems I would recommend to use the following configuration.

A note on static IP and is this update needed for your setup: by static IP I mean if the Ubuntu Server or Debian installation is configured with static IP in network interfaces (like some of the VPS providers), and NOT that you have set a static IP from your router to your server! The later is called static DHCP or DHCP reservation, when your server is configured as DHCP; your router always assigns the same IP address to a specific computer on your LAN (put it simply: the router's DHCP function assigns the static IP to the unique MAC address of the server's NIC). If you are using static DHCP or DHCP reservation, then you should complete the steps in the guide, and not use the below workaround.

If you need to enter IP, Netmask and Gateway on your server, then you need to use this method described in this section. The main difference compared to the method described in the guide is that we will not use update-resolv-conf for DNS, but configure the two primary DNS servers of PIA, and the third DNS server of Google in the network interfaces. Proceed as following:

Edit openvpn.conf to remove update-resolv-conf from up call

sudo nano /etc/openvpn/openvpn.conf Locate the line down /etc/openvpn/update-resolv-conf and disable this line by putting a # at the beginning. Should look like this:

  1. down /etc/openvpn/update-resolv-conf

Hit Ctrl+X, Y and Enter to Save and Exit.

Next edit routing.sh script, where we will disable the call for update-resolv-conf

sudo nano /etc/openvpn/routing.sh Locate the line (should be at the end of the script): /etc/openvpn/update-resolv-conf and put a # at the beginning of the line. Should look like this:

  1. run update-resolv-conf script to set VPN DNS
  2. /etc/openvpn/update-resolv-conf

Hit Ctrl+X, Y and Enter to Save and Exit.

You can leave out the Configure VPN DNS Servers to Stop DNS Leaks section, if you didn't already complete it. If yes, no problem, as we will not use update-resolv-conf at all, we just disabled the calling of the script.

Configure Static IP for Your Server This part is actually something you should already have configured when you installed your server, as you need to configure the IP address, netmask and gateway here. Please use the instructions from your VPS provider or ISP on how to do this (if it is not automatically done for you, as with many VPS).

What we need to do here is to add a DNS entry to make sure the system is using the PIA DNS servers and the third server from Google. Remember, it is very important to use a DNS server you trust, and I would suggest against of using the DNS servers of your ISP.

Edit interfaces

sudo nano /etc/network/interfaces You should see something like this, where address, netmask and gateway should be already filled.

  1. Loopback device:

auto lo iface lo inet loopback iface lo inet6 loopback

  1. device: eth0

auto eth0 iface eth0 inet static 

address   5.X.XXX.XXX 
netmask   255.255.255.224
gateway   5.X.XXX.XXX

Here you need to add the DNS server line after the gateway entry, should look like this (don't change anything else). Remember, you can use other DNS servers, but make sure you use one that you trust.

  1. Loopback device:

auto lo iface lo inet loopback iface lo inet6 loopback

  1. device: eth0

auto eth0 iface eth0 inet static 

address   5.X.XXX.XXX 
netmask   255.255.255.224
gateway   5.X.XXX.XXX
dns-nameservers 209.222.18.222 209.222.18.218 8.8.8.8

Hit Ctrl+X, Y and Enter to Save and Exit.

That's it, now do a system restart, and Split Tunnel should be working with DNS name resolution using secure DNS servers.

Sources

https://www.htpcguides.com/compile-latest-openvpn-from-source-on-debian-8/
https://www.htpcguides.com/force-torrent-traffic-vpn-split-tunnel-debian-8-ubuntu-16-04/

Retrieved from "https://wiki.jamesclaus.com/index.php?title=Split_tunneling&oldid=786"
Powered by MediaWiki