0

I have a VPN which has setup a default route, which is (of course) different to my gateway. All my traffic therefore gets routed through the tunnel.

however i would like to exempt certain apps from going through the tunnel.

Using pfctl i was able to do the following:

pass out quick route-to (en0 192.168.0.1) group specialgrp flags any

To send all traffic from apps belonging to the "specialgrp" (gid) out the standard gateway rather than the tunnel.

This works, in so far as the traffic does appear on the standard gateway when i use tcpdump - however the source ip address is not correct, it's set to the address given to me by the VPN (a 10.0.0.0/8 address) rather than my local ip address, as a result the app can't operate, as the source ip is incorrect.

How do i correctly set the source ip of the outgoing packets so that they're set to the ip address of my computer, rather than the VPN?

thanks

2

You could try some kind of re-write script - the tcprewrite tool in linux (it may not exist in OSX) can rewrite packets stored in the a tcpdumpfile. You could then couple this with TCPrelay which, er, replays the re-written tcpdump pcap files.

https://linux.die.net/man/1/tcprewrite

If that seems too much effort (tbh, I could see why) you could try some proxy software that offers some kind of re-write capability. A quick google has shown Charles to be one such, imagine there are others. There is a cost associated with this one, but you can trial it.

https://www.charlesproxy.com/documentation/tools/rewrite/

As I say, I'm sure others are available. No affiliation with Charles, just the first one that I found.

  • Hm ,so it's just not possible to do what i want using pfctl ? I was thinking i just needed some king of nat rule, i just wasn't sure exactly what it is – horseyguy May 13 at 9:51
  • Sorry, I'm not familiar with pfctl. Was just reading and this was what occurred to me. – FiddleDeDee May 13 at 11:24
  • Gah, tried to edit and had been logged out. Anyway, I think Seamus' post above should sort you out! – FiddleDeDee May 13 at 11:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .