openvpn split tunnel

answered 2019-01-25 07:31:50 +0200

melg01
6069 ●57 ●75 ●68

updated 2019-01-25 07:40:22 +0200

It's a perfectly valid requesr. Split VPN - or individually targeted routing, can be desirable in some situations, even from a business perspective. Let me point you to three typical use cases, that may arise when working remotely, e.g. at home office or as a consulter or technician at the site of your client, connected simultaneously to two networks:

• privacy: you don't want your private internet traffic going through your employers network, while you're accessing the business ressources. This is valid from the employers point of view as well: he has no log files of what else you do, it's nothing of his business.
• access of local ressources: you need to use ip-ressources which are on another network, e.g. your network printer at home or some storage.
• You set up a VPN tunnel between two partners and want to specify the different routing possibilities.

Of course, there are serious security issues to this kind of setup with split-vpn, and I'd probably not allow it in my business. But as a request and sometimes even need, it can make sense.

answered 2019-07-30 23:15:37 +0200

JulienBlanc
563 ●12 ●15 ●19

Replying to myself, i found how to do this properly.

Edit your vpn provider configuration :

/home/.system/var/lib/connman-vpn/provider_xxx_sailfishos/settings

add the following :

DefaultRoute=false

(just after Host=xxx, for example).

Reboot your phone, and voilà !

Now ask jolla why this settings is not available in the default interface :(

answered 2019-01-24 21:43:40 +0200

dominican
256 ●13 ●19 ●21

That's not a bug, when sailfish route all the traffic through the VPN, it's protecting you from an insecure WLAN connection, and that's something that personally i love from sailfish OS X, maybe as @gabriel says, you must request a new feature to Jolla.

answered 2019-07-30 20:46:28 +0200

JulienBlanc
563 ●12 ●15 ●19

I have the same request, and i’ll add i consider this a bug.

Routes should be set by the VPN server : adding a default route just render them unusable. Other openvpn clients do not do this, they honor the routes set by the server. Since the problem does not reside at openvpn level, there is simply no way from the server to prevent this (basically, connecting to a non routing server vpn just break all internet connection on the device).

Whether this is a “safe” setup is up to debate (it depends on what you use your vpn for). But the fact is that it is a fully supported openvpn setup.

As a side note, this behaviour also prevents from connecting to multiple VPNs at once (which, again, is a perfectly valid openvpn supported scheme, working without issues from any linux box).