Otdfbt

I have CentOS Linux 6 based software router. I have 2 local networks, lets say Local1 and Local2. I have one Internet connection, and I have VPN connection that I run via this Internet one.

I use iptables and DHCP server to share Internet connection. When I enable VPN, both Local1 and Local2 traffic goes through VPN, without VPN both local networks go directly to Internet.

My question follows: how to set up CentOS based software router to forward one local network via VPN and another one directly?

I can't tell you how... but I can tell you theoretically.

Most likely, your VPN consists of only a specific network (or set of networks). You would want to set up Split Tunneling to say in Pseudo: "Any traffic destined for 'VPN network,' go through VPN Connection." Then your 0.0.0.0 default route would be all set up to go out through the internet connection.

I also believe priority matters. Be sure the route for the VPN Network has a higher priority than your default route.

First you have to change VPN configuration to not setup itself as a default gateway. What VPN is this?
Second you have to add iptables rule to forward traffic from Local2(eth0) to VPN(tun0)
ex.commands: iptables -I FORWARD -i eth0 -o tun0 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
and second
iptables -t nat -I POSTROUTING -o tun0 -s 192.168.0.0/24 -j MASQUERADE

Finally I found a way. It is required to use iproute2, but some not obvious things are present.

1. Use ip rule to create source-based routing policy.


2. Use ip route .... table to add 3 routs to source-based routing policy: one that sets Internet default gateway, and 2 ones that set gateways for both local networks. It doesn't work without local networks gateways setup, probably because OpenVPN makes a lot of changes in routing table.


3. Important: ip rule and ip route don't persist, so the rules disappear on reboot. It is common to use rule-interface and route-interface files to set static routes. However, these files are problematic when you use them with DHCP and/or Wi-Fi hotspot. The reason is that these files are applied in parallel to (so some times before) DHCP and hostapd initialization. That is why these 2 files result in incorrect routing table often. I use rc.local to add routes and rules with command line on system startup instead, and with this approach I am able to route one local NIC via VPN and another one directly.

You need to use VPN without default gateway defined, so all your traffic will goes through old default gateway.

Then you can add the static route which will forward traffic to the local1 subnet to the VPN gateway.