On 2011/08/16 12:08, Stefan Sperling wrote:
> In some networks (e.g. at public events using open wifi) I want
> traffic not destined for the local network to go through a VPN.
>
> If the local network uses DHCP, I usually end up killing dhclient
> because it's impossible to renew the lease without changing the
> default route.
>
> To be clear, I end up with a command sequence like:
>
> dhclient wpi0 # get a local address
> netstat -rn -finet | grep ^default # figure out local router
> route delete default # don't use local router for everything
> route add -host $VPN_SERVER_IP $LOCAL_ROUTER # just for this host
> openvpn config-file # start VPN, i am too dumb for ipsec
For OpenVPN you should be able to do '--redirect-gateway def1'
assuming you have sbin/route/route.c r1.153 or newer. (though for
an OpenBSD-OpenBSD connection, I find IPsec much easier to
configure than OpenVPN).
> route add default $ROUTER_BEHIND_VPN # use my trusted router as default
> pkill -x dhclient # kill dhclient to avoid default route change later
>
> The problem is that the lease expires at some point and things
> usually stop working until I perform the same tedious configuration
> dance again.
>
> The patch below adds a new option to dhclient.conf (the VPN server is
> at 10.1.1.1 in this example):
>
> interface "wpi0" {
> host-route 10.1.1.1;
> }
If it's not considered of enough general use to change dhclient
itself, I think this might be something you could achieve by using
an alternative dhclient-script via 'script "/path/to/script";' e.g.
copy new_router to another var, unset new_router, call the original
dhclient-script, and add the host-route afterwards.
Either way (your patch or with a wrapper script) if a new IP address
is assigned you might have some problems with delete_old_routes
flushing all routes including the route over the tunnel; not sure
how important this is in practice in your case, but I think it
would be generally useful to be able to prevent this from occurring
(this would also let you fetch an address on an interface via DHCP
without changing routes, sometimes it can be rather useful to do
this on a machine where changing the default route will cause
disruption..)
