Could you please show me a rule so I can "try it"? I'd love it if this worked.
Let's say:
- the physical interface name is "wlan0"
- the VPN virtual interface name is "tun0"
- the VPN server is 10.1.1.1 on TCP port 8888
- the DHCP server on initial lease sends "0.0.0.0/0 via 10.8.8.8"
- the DHCP server on renew sends the above rule and also "10.0.0.0/8 via 10.9.9.9"
- Before the renew, traffic not routed via 10.8.8.8 is blocked
- After the renew, traffic with a destination IP matching 10.0.0.0/8 not routed via 10.9.9.9 is blocked
What should the firewall rule look like to let the VPN connection stay up both before and after the new rule, while also ensuring that traffic to 10.7.7.7 goes via the VPN and not via 10.9.9.9 or 10.8.8.8?
EDIT: you keep saying "I'm wrong" but I'm just asking how this firewall rule can be structured to do what you say. It occurs to me that perhaps you're saying you can make traffic for 10.7.7.7 get blocked. But in the above, and before, what I'm asking for is how to make traffic for 10.7.7.7 continue to get sent over the VPN after the new rule addition, just like it was before - in other words, no dropped packets.
Let's say:
- the physical interface name is "wlan0"
- the VPN virtual interface name is "tun0"
- the VPN server is 10.1.1.1 on TCP port 8888
- the DHCP server on initial lease sends "0.0.0.0/0 via 10.8.8.8"
- the DHCP server on renew sends the above rule and also "10.0.0.0/8 via 10.9.9.9"
- Before the renew, traffic not routed via 10.8.8.8 is blocked
- After the renew, traffic with a destination IP matching 10.0.0.0/8 not routed via 10.9.9.9 is blocked
What should the firewall rule look like to let the VPN connection stay up both before and after the new rule, while also ensuring that traffic to 10.7.7.7 goes via the VPN and not via 10.9.9.9 or 10.8.8.8?
EDIT: you keep saying "I'm wrong" but I'm just asking how this firewall rule can be structured to do what you say. It occurs to me that perhaps you're saying you can make traffic for 10.7.7.7 get blocked. But in the above, and before, what I'm asking for is how to make traffic for 10.7.7.7 continue to get sent over the VPN after the new rule addition, just like it was before - in other words, no dropped packets.