The issue
My client machine is connected to an openvpn server.
All the traffic is sent through the VPN and everything works fine.
I started to run a couple of software on some dockers recently, and I would like the traffic of all the dockers not to be directed via the VPN.
Here are my routes when the VPN is turned off :
Code: Select all
Destination Gateway Genmask Indic Metric Ref Use Iface
default 192.168.10.1 0.0.0.0 UG 100 0 0 enp2s0
link-local 0.0.0.0 255.255.0.0 U 1000 0 0 enp2s0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.10.0 0.0.0.0 255.255.255.0 U 100 0 0 enp2s0
Here are my routes when the client is connected to the VPN :
Code: Select all
Destination Passerelle Genmask Indic Metric Ref Use Iface
default _gateway 0.0.0.0 UG 50 0 0 tun0
default _gateway 0.0.0.0 UG 100 0 0 enp2s0
10.8.0.0 0.0.0.0 255.255.255.0 U 50 0 0 tun0
vps-2224a3f4.vp _gateway 255.255.255.255 UGH 100 0 0 enp2s0
link-local 0.0.0.0 255.255.0.0 U 1000 0 0 enp2s0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.10.0 0.0.0.0 255.255.255.0 U 100 0 0 enp2s0
_gateway 0.0.0.0 255.255.255.255 UH 100 0 0 enp2s0
vps-2224a3f4.vp is the hostname of the OpenVPN server.
Basically, I'd like to route everything except 172.17.0.0 to the VPN.
I tried to add these lines in my client.ovpn but it didn't work :
Code: Select all
pull-filter ignore "redirect-gateway"
route 192.168.10.0 255.255.255.0 route_vpn_gateway
route 172.17.0.0 255.255.0.0 route_net_gateway
Informations
OpenVPN server : OpenVPN 2.4.7 x86_64-pc-linux-gnu
OpenVPN client : OpenVPN 2.4.7 x86_64-pc-linux-gnu
Here is the client conf.ovpn :
Code: Select all
client
proto udp
remote public_IP 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_b2YrpwwxLm837xGC name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
pull-filter ignore "redirect-gateway"
route 192.168.10.0 255.255.255.0 route_vpn_gateway
route 172.17.0.0 255.255.0.0 route_net_gateway
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MII........0V
WYHUBAB9cyCdNSNbkGCXHxRBy2hJ
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MII.....4g==
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
M.....Gg
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
0c66533.........b008
-----END OpenVPN Static key V1-----
</tls-crypt>
Here is my server conf :
Code: Select all
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 5 20
reneg-sec 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 213.186.33.99"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_b2YrpwwxLm837xGC.crt
key server_b2YrpwwxLm837xGC.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3