Force Torrent Traffic through VPN Split Tunnel Debian 8 + Ubuntu 16.04

openvpn-logo-squareWe have showed you how to configure VPN Split Tunnel on Ubuntu Server 14.04 LTS, now we bring you the next sequence in the split tunnel guides: the VPN Split Tunnel guide for systemd systems like Debian 8 and Ubuntu 16.04. In this guide we will show you how to configure Split Tunnel on Ubuntu Server 16.04 LTS, Debian 8, Minibian and Raspbian Jessie (on Raspberry Pi). You will be able to route your torrent traffic over your VPN connection, while everything else will have direct access, bypassing the VPN. Network traffic will be elegantly and securely separated.

You have full control over which applications you want to route over VPN. You will have an Automatic Kill Switch implemented (using firewall rules) so if your VPN connection drops or breaks, your real IP address will not be revealed and torrent traffic will stop. DNS leaks are also prevented. Remote access to your Torrent client of choice (Transmission or Deluge) is possible with nginx reverse proxy.

VPN Service
All Platforms
Number of Connections
Monthly Cost
Annual Cost
Private Internet Access
($3.33 / month)
Pure VPN
($4.16 / month)
($6.41 / month)

It is very important to protect your online privacy. We would certainly recommend using a VPN (Virtual Private Network) with OpenVPN. Luckily, there are many paid VPN servers available with excellent performance at great price. Always read their Privacy Policy, consider the quality of the service for the price and choose one you trust. In this guide we will use Private Internet Access (PIA) as the VPN provider, in my experience configuring others will not differ too much.

Important: This guide is written for Ubuntu Server 16.04 LTS and Debian 8 systems (like Minibian, Raspbian, Bananian) that uses systemd services. It might work on other Linux distributions, but it is guaranteed to work on Ubuntu Server 16.04 LTS and Debian 8. For systems that use upstart script (like Ubuntu Server 14.04 LTS), upstart scripts are required instead of systemd service. If you are using Ubuntu Server 14.04 LTS, jump to the Force Torrent Traffic VPN Split Tunnel Ubuntu 14.04 guide.

The sections which are marked Minibian are needed only if you are, well, running Minibian. Ubuntu Server 16.04 LTS users should skip those parts (it will be always indicated in the relevant section).

Why Split VPN Tunnel?

If you are running a home server based on Ubuntu Server and you configure your OpenVPN client, you will be completely tunneled over the active VPN connection. But what if we would like to tunnel only few applications’ traffic over VPN (for example Transmission or Deluge) and allow everything else direct connection? This is called split tunneling the VPN connection. What if your VPN connection breaks because the VPN server is offline? Without proper firewall rules you will automatically fall back to your direct Internet connection and immediately expose your real IP address. This poses privacy and anonymity risks!

The Benefits of VPN Split Tunneling


You can select which services/applications should be tunneled over the VPN connection by running the selected services/application as vpn user, therefore you can protect your identity.


The VPN connection with Split Tunneling is started automatically on each system start, restarted automatically once the VPN provider is online again.

Increased Safety

If the VPN connection breaks, the vpn user is “disconnected” from the Internet (Automatic Kill Switch), if VPN connection is established again, vpn user will have access to Internet again over VPN. This ensures that your real IP address is never exposed publicly, only the IP address assigned by VPN provider is visible.

Increased Convenience

You retain you direct internet connection for all the other users, bypassing the VPN for services/applications that don’t require you to hide your real IP address

Keep Remote Access

You will still be able to remotely manage your services by reverse proxy!

Installation Overview

This is an advanced guide but every effort has been made to make it friendly for new users with basic Linux knowledge. Should anything go wrong, feel free to comment or post on the Forum, we will do our best to help you. Since the publication of the VPN Split Tunnel guide for Ubuntu Server 14.04 LTS there are many interesting posts in the forum section.

This is Part 1 of the split tunnel guide. In this guide you will create and configure the vpn user.

In Part 2 of upcoming guides you will configure your torrent client (Transmission or Deluge) to run as the VPN user.

Here is an overview of all the steps in Part 1:

  • Install and configure OpenVPN (including auto connecting to VPN server on system start)
  • Modify PIA configuration file to adjust for Split Tunneling
  • Configure DNS Server for VPN connection to prevent DNS leak
  • Create the vpn user that will be tunneled over VPN
  • Use iptables to mark vpn user’s traffic and routing rules to route marked packets over VPN connection
  • Check everything is configured and working correctly

Install OpenVPN

Unfortunately, the Ubuntu and Debian repositories are not always up to date. It is recommended to use the latest OpenVPN release to make sure you have the latest security fixes (and possible updates). In case of Ubuntu Server 16.04 the official OpenVPN repository always provides the latest version. In case of ARM CPUs like the Rasperry Pi running Raspbian or Minibian, we need to build the latest version since the OpenVPN repository doesn’t provide builds for ARM based devices. It is quite easy to build OpenVPN from source (stay tuned for the guide), until then, on Debian, Minibian and Raspbian you can use the version available in the Debian repository.

Install OpenVPN on Ubuntu Server 16.04 LTS

If you are using Ubuntu Server 16.04 LTS we will install OpenVPN from the official OpenVPN repository. First import the public GPG key that is used to sign the packages.

wget -O - | sudo apt-key add -

Add the OpenVPN repository

echo "deb xenial main" | sudo tee -a /etc/apt/sources.list.d/openvpn.list

Install OpenVPN

sudo apt-get update
sudo apt-get install openvpn -y

Install OpenVPN on Debian 8 (Minibian, Raspbian)

Since OpenVPN repository doesn’t support ARM based devices, we have two options. Use the OpenVPN version available in the Debian repository (probably quite outdated version), or build the latest OpenVPN version from source (the link to the guide will be posted here soon).

This will install OpenVPN from the Debian repository

apt-get update
apt-get install openvpn -y

Create systemd Service for OpenVPN

The systemd service is identical for both Ubuntu Server 16.04 LTS and Debian 8 and later (includes Raspbian, Bananian, Minibian)

Note: on Minibian you do not have to use sudo

With transition to systemd, OpenVPN uses individual systemd service scripts for each connection, and these can be started and stopped with systemctl command. It is really a great way of handling connections, you can read more about at this link.

Create the systemd service that will start the required OpenVPN configuration on system start

sudo nano /etc/systemd/system/openvpn@openvpn.service

This script will also restart OpenVPN service if the service was terminated for some reason, logs will be located in syslog (/var/log/syslog).

Copy and paste the following

# HTPC Guides -
Description=OpenVPN connection to %i

ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/
ExecReload=/bin/kill -HUP $MAINPID
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw


Hit Ctrl+X, Y and Enter to save.

Now enable the openvpn@openvpn.service we just created

sudo systemctl enable openvpn@openvpn.service

Double Check Packages for Minimal Debian Distros

On Debian 8, Raspbian and Minibian the procedure is exactly the same as on Ubuntu Server 16.04 LTS, except that we need to install some additional packages. If you are using Ubuntu Server 16.04 LTS, just skip this Minibian part of the guide and proceed to the next section Create PIA Configuration File for Split Tunneling.

First, I recommend to update the RPi firmware to the latest version by running

apt-get update
apt-get install rpi-update

Then update the firmware


followed by a reboot


Next, make sure Minibian is up to date, run

apt-get upgrade -y
apt-get dist-upgrade -y

Depending on your current Debian or Minibian installation, some of the below packages might be already available. In this case, you can still safely issue the below install commands.

apt-get install nano sudo apt-utils iptables curl resolvconf

Now your minimal Debian installation is ready to proceed with the VPN Split Tunnel configuration.

Create PIA Configuration File for Split Tunneling

The next step is to modify the configuration file provided by PIA to adjust it for the Split Tunneling. In this guide we will use the Sweden VPN server, but you can use any of the available servers – more on this later. For best VPN performance (especially for torrents) I strongly recommend using UDP protocol, and not TCP.

Get the Required Certificates for PIA

If unzip is not installed on your server, just install with

sudo apt-get install unzip -y

Download the archive from PIA, we will need only the certificates

cd /tmp
sudo wget
sudo unzip

Copy the required PIA certificates

sudo cp crl.rsa.2048.pem ca.rsa.2048.crt /etc/openvpn/

Create Modified PIA Configuration File for Split Tunneling

We make the following changes to the default PIA configuration file:

  • Add route-noexec to prevent the server from push “redirect-gateway” and make the client send all traffic over VPN by default.
    • This is required for Split Tunneling to work.
  • Add auth-nocache to prevent caching passwords in memory.
  • Add the call for login.txt file with the username and password to make automatic login possible.
  • Add script-security 2 to allow client to call externals scripts (up and down).
  • Call the first script,, to mark packets for the VPN user (OpenVPN allows only one up call).
  • Add down script, update-resolv-conf, to restore DNS servers when disconnecting from VPN.

You can change the hostname highlighted in red to the server of your choice. For the list of available locations and hostnames look at PIA’s site and select the hostname of your choice.

We are editing the openvpn.conf file which is launched by the systemd service we created earlier (openvpn@openvpn.service). This way we ensure the up and down scripts we made are also executed with the OpenVPN systemd service is restarted.

Create the OpenVPN configuration file

sudo nano /etc/openvpn/openvpn.conf

Copy and paste the following, adjust the country you want to use by replacing

dev tun
proto udp
remote 1198
resolv-retry infinite
cipher aes-128-cbc
auth sha1
remote-cert-tls server
auth-user-pass /etc/openvpn/login.txt
verb 1
reneg-sec 0
crl-verify /etc/openvpn/crl.rsa.2048.pem
ca /etc/openvpn/ca.rsa.2048.crt
script-security 2

#up and down scripts to be executed when VPN starts or stops
up /etc/openvpn/
down /etc/openvpn/update-resolv-conf

Hit Ctrl+X, Y and Enter to Save and Exit.

Make OpenVPN Auto Login on Service Start

The username and password for PIA will be stored in a login.txt file, this way OpenVPN can auto connect on service start. Create the txt file

sudo nano /etc/openvpn/login.txt

Enter your PIA username and password


Hit Ctrl+X, Y to Save and Exit.

Configure VPN DNS Servers to Stop DNS Leaks

Next we are going to prevent DNS leak. DNS Leaks are often the main reason your real identity gets exposed even if using VPN. You can read more about DNS leaks at here. The update-resolv-conf script that comes with OpenVPN will automatically apply the preferred DNS servers when OpenVPN connects.

This script will make sure that when using OpenVPN you are not subject to DNS leaks. We will use PIA’s DNS Servers ( and and Google’s ( as a third option. You are free to use the DNS servers you trust and prefer. It is advised to change the local DNS to a public even if you are not using VPN. If you are behind a router (and you probably are), it is also a good practice to configure public DNS address on the router too.

Note: make sure you are using a static IP on your machine or reserved DHCP also known as static DHCP. Do not configure the static IP on your server, as resolvconf will not work then. You should set the static IP from your router!

Open the update-resolv-conf file

sudo nano /etc/openvpn/update-resolv-conf

Locate this part

# foreign_option_1='dhcp-option DNS'
# foreign_option_2='dhcp-option DNS'
# foreign_option_3='dhcp-option DOMAIN'

Replace the part highlighted in red, make sure you uncomment (remove the # from beginning) these 3 lines, and pay attention to the third line where your need to replace DOMAIN with DNS.

It should look exactly like this

foreign_option_1='dhcp-option DNS'
foreign_option_2='dhcp-option DNS'
foreign_option_3='dhcp-option DNS'

Hit Ctrl+X, Y and Enter to Save.

Your DNS is configured for OpenVPN to prevent DNS leaks.

Split Tunneling with iptables and Routing Tables

We will use iptables to mark packets from a user (in our case the vpn user), and then use routing tables to route these marked packets through the OpenVPN interface, while allowing unmarked packets direct access to the Internet.

Create vpn User

Create the user vpn. All of the applications you want tunneled over VPN will run as this user, especially your torrent client of choice (Transmission or Deluge). At the end of this guide you will see the links to our guides on how to configure Transmission and Deluge with Split Tunneling.

Create vpn user with no login option

sudo adduser --disabled-login vpn

I suggest to leave personal details blank, just proceed with Enter, and finally answer Y to create vpn user. We disabled login for the vpn user for security reasons, there is no need to log in to the system as the vpn user.

We are going to use the vpn user to run services (like Torrent client), it is recommended to add your regular user to the vpn group and vpn user to your regular user’s group to avoid any permission issues.

Replace username with the user you would like to add to the vpn group

sudo usermod -aG vpn username

Replace group with the group name of your regular user that you would like to add the vpn user to

sudo usermod -aG group vpn

Get Routing Information for the iptables Script

We need the local IP and the name of the network interface. Again, make sure you are using a static IP on your machine or reserved DHCP also known as static DHCP, but configured on your router!

ip route list

The output will be similar to this

default via dev eth0 dev eth0 proto kernel scope link src

eth0 is the network interface (NETIF), and is the local IP address (LOCALIP). You will need to enter these two into the following script, which we are going to create now.

iptables Script for vpn User

The first script will mark the packets for vpn user, the second script will take care of proper routing.

Create the iptables script

sudo nano /etc/openvpn/

Copy the following to the script, and make sure you enter the network interface and the local IP we identified and marked with red and blue respectively.

You can see the comments for each section about the function of the given part of the script. If you are interested in more details about iptables, a good starting point is the Official Ubuntu Documentation.

Remember, this script will flush your existing iptables rules (UFW included), therefore you need to append your own rules into this script if you need any additional firewall rules.

#! /bin/bash
# Niftiest Software –
# Modified version by HTPC Guides –

export INTERFACE="tun0"
export VPNUSER="vpn"
export LOCALIP=""
export NETIF="eth0"

# flushes all the iptables rules, if you have other rules to use then add them into the script
iptables -F -t nat
iptables -F -t mangle
iptables -F -t filter

# mark packets from $VPNUSER
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT ! --dest $LOCALIP -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p udp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT --dest $LOCALIP -p tcp --dport 53 -m owner --uid-owner $VPNUSER -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT ! --src $LOCALIP -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

# allow responses
iptables -A INPUT -i $INTERFACE -m conntrack --ctstate ESTABLISHED -j ACCEPT

# block everything incoming on $INTERFACE to prevent accidental exposing of ports

# let $VPNUSER access lo and $INTERFACE
iptables -A OUTPUT -o lo -m owner --uid-owner $VPNUSER -j ACCEPT
iptables -A OUTPUT -o $INTERFACE -m owner --uid-owner $VPNUSER -j ACCEPT

# all packets on $INTERFACE needs to be masqueraded

# reject connections from predator IP going over $NETIF
iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT

# Start routing script

exit 0

Hit Ctrl+X, Y and Enter to save and exit.

Make the iptables script executable

sudo chmod +x /etc/openvpn/

Routing Rules Script for the Marked Packets

With the routing rules we configure the route for the packets we just marked with the first script. You can read more about the routing tables at the following link.

Create the routing script

sudo nano /etc/openvpn/

Paste the following script which makes the default route after the VPN the loopback interface, effectively nulling the traffic if the VPN connection goes down.

#! /bin/bash
# Niftiest Software –
# Modified version by HTPC Guides –

GATEWAYIP=$(ifconfig $VPNIF | egrep -o '([0-9]{1,3}\.){3}[0-9]{1,3}' | egrep -v '255|(127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | tail -n1)
if [[ `ip rule list | grep -c 0x1` == 0 ]]; then
ip rule add from all fwmark 0x1 lookup $VPNUSER
ip route replace default via $GATEWAYIP table $VPNUSER
ip route append default via dev lo table $VPNUSER
ip route flush cache

# run update-resolv-conf script to set VPN DNS

exit 0

Hit Ctrl+X, Y and Enter to Save and Exit.

Finally, make the script executable

sudo chmod +x /etc/openvpn/

Configure Split Tunnel VPN Routing

We will need a routing table by adding the table name to the rt_tables file (in our case it is vpn). Open rt_tables

sudo nano /etc/iproute2/rt_tables

Add the vpn user table at the bottom of the file

200     vpn

It should look similar to this:

# reserved values
255     local
254     main
253     default
0       unspec
# local
#1      inr.ruhep
200     vpn

Hit Ctrl + X, Y and Enter to save and exit.

Change Reverse Path Filtering

Finally, we need to change the default level of reverse path filtering to ensure the kernel routes the traffic correctly. By default it is set to value of 1 that is “strict mode”. It is not necessary to disable reverse path filtering completely (setting to “0”), but we need to set it to level 2, “loose mode”.

Create a reverse path filter file for the vpn user

sudo nano /etc/sysctl.d/9999-vpn.conf

Copy the following, make sure you use the correct network interface name in the third line marked with red (remember the ip route list command from before and the output, in our case it was eth0)

net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.eth0.rp_filter = 2

Hit Ctrl + X, Y and Enter to save and exit.

To apply new sysctl rules run:

sudo sysctl -p

Testing the VPN Split Tunnel

I recommend a system restart, and if everything was configured properly, you should have a running OpenVPN service enabled for the vpn user and all the other users on your server should have direct access to Internet. Now lets check if everything is correct.

Test OpenVPN service

Login as your regular user over SSH, and check OpenVPN service status

sudo systemctl status openvpn@openvpn.service

This should return something like this

openvpn@openvpn.service - OpenVPN connection to client
 Loaded: loaded (/etc/systemd/system/openvpn@openvpn.service; enabled; vendor preset: enabled)
 Active: active (running) since Mon 2016-09-05 11:25:18 CEST; 1 day 4h ago
 Docs: man:openvpn(8)
 Process: 3223 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn
 Main PID: 3266 (openvpn)
 CGroup: /system.slice/system-openvpn.slice/openvpn@openvpn.service
 └─3266 /usr/sbin/openvpn --daemon ovpn-client --status /run/openvpn/client.status 10 --cd /etc/openvpn

Sep 05 11:25:21 server ovpn-client[3266]: OPTIONS IMPORT: route options modified
Sep 05 11:25:21 server ovpn-client[3266]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified

Systemd gives a very nice overview about the service state. In the above example you can see that the service is Active (running), just as we need.

If the service is not running you can check if there is a log of the error in /var/log/syslog . For troubleshooting you can set output verbosity in the openvpn.conf file to a higher level. Set it to 3 and check the syslog again. You can always ask for help in the forum section. Remember to set verbosity level back to 1 if you don’t need more detailed logs anymore.

Check IP address

Using the SSH session for the regular user, check the IP address


It will return your IP and depending on how much information is provided, the country should be listed in each case. Obviously, it should be your ISP now and your location.

Now check the IP address of the vpn user with

sudo -u vpn -i -- curl

If everything went fine, it should return the IP address and the country of the VPN server you selected. If you used Sweden server, then the country should be “SE”. It is very important that the IP address for user vpn should be different then your regular user’s IP.

In my case for user vpn and using Sweden PIA server I have the following output

  "ip": "X.XXX.XXX.XX",
  "hostname": "No Hostname",
  "city": "",
  "region": "",
  "country": "SE",
  "loc": "59.3294,18.0686",
  "org": "AS57858 Inter Connects Inc"

Obviously, the “” part is my assigned VPN IP address which is different then my public IP, and you can see the country as SE which is Sweden.

Check DNS Server

Finally, check if the DNS for VPN is properly configured, type

sudo -u vpn -i -- cat /etc/resolv.conf

The output should be

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)

If you see the above DNS servers then your DNS for VPN is configured correctly.


Congratulations, now you have configured your Ubuntu Server 16.04 LTS or Debian 8 for VPN with Split Tunneling. You should now install your Torrent client of choice and configure it for Split Tunneling:

Note: the guides with systemd service for the Torrent clients will be published soon!