OS X OpenVPN packet filtering

Question

I currently have an OpenVPN connection running on my Mac. By default, all of my network traffic is currently being routed through this connection: http, ssh, etc. I'm attempting to use packet filtering configurations to make certain traffic go through my standard 'public' connection, but I can't seem to get this to work. I may be configuring it incorrectly, but below is what I have. I don't receive an error from pfctl about my config, but if I curl http://ipecho.net/plain, it displays the VPN IP instead of my public IP.

Note: my public interface is an ethernet connection (en0) and from what I can tell, utun0 is my OpenVPN connection listed in ifconfig.

pass out on en0 proto tcp from en0 to any port 80 flags S/SA keep state

Same with SSH.

pass out on en0 proto tcp from en to any port 22 flags S/SA keep state

I should mention that I do not manage the OpenVPN server.

Answer 1

I presume that what you use OpenVPN for, then, is just to gain access to your home LAN. If this is indeed the case, there are several options to override the usual

      push "redirect-gateway def1"

setting in the server.conf. You find them described on this OpenVPN Wiki page, the simplest one of them all is to add these four lines to your client config file:

     route 0.0.0.0 192.0.0.0 net_gateway
     route 64.0.0.0 192.0.0.0 net_gateway
     route 128.0.0.0 192.0.0.0 net_gateway
     route 192.0.0.0 192.0.0.0 net_gateway

The Wiki states explicitly:

Note that net_gateway is an internal variable to openvpn and does not need to be changed to anything

and, even more reassuringly, says that these four lines will work ...

If you do not know if your server uses def1 and do not want to check the logs to figure it out, just assume they DO use def1 and use the 4 routes. That will work no matter what.