iPtables routing one specific IP outside VPN

[Steve1985]

Hello,

I would like to be able to allow one specific IP adress to be accessed outsite the VPN (using OpenVPN, AirVPN in MerlinWRT latest firmware 55).
So all other traffic should be handled within the tunnel except for connecting to that specific IP.

This has to do with accessing the online library of my university that whitelists on IP and using the VPN service gives me a to dynamic IP adress unfortunately because of disconnects and saving settings etc.

Can anyone help me setting this up using iptables? Found a lot of info on the web port forwarding etc to a LAN IP but couldn't find much info on this specific situation.

Thanks!

Steve

 

[RMerlin]

Hello,

I would like to be able to allow one specific IP adress to be accessed outsite the VPN (using OpenVPN, AirVPN in MerlinWRT latest firmware 55).
So all other traffic should be handled within the tunnel except for connecting to that specific IP.

This has to do with accessing the online library of my university that whitelists on IP and using the VPN service gives me a to dynamic IP adress unfortunately because of disconnects and saving settings etc.

Can anyone help me setting this up using iptables? Found a lot of info on the web port forwarding etc to a LAN IP but couldn't find much info on this specific situation.

Thanks!

Steve

Read the included documentation regarding Policy-based routing. It's all configurable through the webui now.

 

[Steve1985]

Hi Merlin,
I found the routing in the webUI very nice! could you eloborate a litle bit? do i have to make seperate rules for every single client or can i make one rule that applies to all clients. And how do i say 192.168.1.* should be allowed to acces <IP university> outside tunnel?

 

[RMerlin]

Hi Merlin,
I found the routing in the webUI very nice! could you eloborate a litle bit? do i have to make seperate rules for every single client or can i make one rule that applies to all clients.

I recommend reading the documentation about this in the README file, there's a few examples there to help you get started.

And how do i say 192.168.1.* should be allowed to acces <IP university> outside tunnel?

You can use CIDR denotation. 192.168.1.0/24 for instance means 192.168.1.1 through 192.168.1.255. You will have to add a second WAN rule however to NOT include your router. WAN rules are applied after VPN rules.

From: 192.168.1.1
To: 0.0.0.0
Intertface: WAN