I'm newbie on Ubuntu and use a lot of torrent to download a lot multimidia content.

Is there a way to auto close a program like torrent when I turn on the VPN client? And When I turn off the VPN client open the torrent again?

3

1 Answer

As requested, here is an example of using cgroups to have certain processes bypass your VPN.

Install required tools:sudo apt-get install cgroup-lite cgroup-tools

Then on each bootup where I want this functionality I do this in a terminal shell:

sudo su
./cgroup_setup.bash
exit

Where cgroup_setup contains something like this (change myuser, mynetworkdevice and mygatewayip as appropriate):

#!/bin/bash
# Define a control group named novpn with a classid of 11:11
sudo cgcreate -a $USER:$USER -t $USER:$USER -g net_cls:novpn
echo 0x00110011 > /sys/fs/cgroup/net_cls/novpn/net_cls.classid
# Change ownership so myuser can run processes bypassing the vpn
sudo chown myuser:myuser /sys/fs/cgroup/net_cls/novpn
sudo chown myuser:myuser /sys/fs/cgroup/net_cls/novpn/*
# Add mark 11 on packets of classid 0x00110011
iptables -t mangle -A OUTPUT -m cgroup --cgroup 0x00110011 -j MARK --set-mark 11
# Force the packets to exit through my interface (mynetworkdevice) with NAT
iptables -t nat -A POSTROUTING -m cgroup --cgroup 0x00110011 -o mynetworkdevice -j MASQUERADE
# Define a new "novpn" routing table
# This is persistent so it does not actually need to be done each time in script...
echo 11 novpn >> /etc/iproute2/rt_tables
# Packets with mark 11 will use novpn
ip rule add fwmark 11 table novpn
# Add a route for default gateway for novpn
ip route add default via mygatewayip table novpn
# Unset reverse path filtering for all interfaces
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $i; done
# Create control group
cgcreate -t $USER:$USER -a $USER:$USER -g net_cls:novpn

Now you can use cgexec to run a process bypassing the VPN for example:

killall firefox
cgexec -g net_cls:novpn firefox

If you run firefox normally with a VPN running you should see that your public facing IP is a VPN IP. But with cgexec bypassing the VPN you can check it's your actual home IP.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy