In this little tutorial i explain how to build a raspberry pi vpn router. This raspi will be equiped with an additional ethernet adapter and work as a router between your pc and your home lan or between portions of your local network. The raspi will use NAT to connect devices connected to eth1 to your ISP or a choice of multiple vpns. What was important for me is to ensure that your device only passes the selected output channel. If the vpn breaks down, no internet even if the second vpn or your isps connection still works. No auto switch to your isp.


  • USB Ethernet adapter
  • Linux skills
  • Rasperry pi with fresh raspbian

How does it work?

Your eth0 is connected to your local lan and gets his routing via dhcp. Your eth1 is connected to your computer. On eth1 dnsmasq serves the 192.168.111.X network of vpn routable devices.

Basically we are enable NAT routing on the raspi and by default null-route everything incoming. After this, we create a separate routing table defgw with your eth0 default gateway aquired by dhcp.

We enable NAT on every tunX for our vpns. Every VPN connection will add a separate routing table vpnX with your raspi as gateway.

Now you can decide to assign an ip out of the private pool 192.168.111.X to a routing table.

If you choose defgw it gets routed to your local network and out to your isp.

If you choose vpnX it gets routed through the specified vpn.

If a route breaks or gets removed, the null-route rule take care of it instead falling back to your default gatework (ISP).

Install software


  • openvpn
  • dnsmasq


Add to /etc/iproute2/rt_tables:

200 vpn1
201 vpn2
152 null
153 defgw

Network setup


source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
    post-up /home/pi/

auto eth1
iface eth1 inet static

The up-script sets up the defgw route.


if [ "$IFACE" != "eth0" ]; then
    echo "No suitable interface"
    exit 0

gw=$(ip route show dev eth0 | grep default | head -n 1 | awk '{print $3}')
if [ -z "$gw" ]; then
    echo "No default gateway found"
    exit 0

ip route add default via $gw dev eth0 table defgw

exit 0



echo "Enable null routing"
ip route add default via dev lo table null
ip rule add from table null
ip rule add from

echo "Enable NAT on eth0"
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# NAT on tunX
echo "Enable NAT on tunX"
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun2 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun3 -j MASQUERADE

echo "Starting vpn service 1"
start-stop-daemon --start --background --make-pidfile --oknodo --user root --name vpn1 --pidfile /var/run/ --startas /home/pi/ --chuid root 
echo "Starting vpn service 2"
start-stop-daemon --start --background --make-pidfile --oknodo --user root --name vpn2 --pidfile /var/run/ --startas /home/pi/ --chuid root

exit 0



openvpn --cd /home/pi/.openvpn --config yourconfig.ovpn --up --script-security 2 --route-nopull

You need a seperate up script for every openvpn connection, change the routing table vpn1 to your need.

So your vpns are clearly distinguished by routing table and not device.


ip route add default via $ifconfig_local dev $dev table vpn1

Switch the routing table

For demonstration purpose i use a connected device with ip

Switch to vpn1:

ip rule add from table vpn1
Remove afterwards:
ip rule del from table vpn1

Switch to vpn2:

ip rule add from table vpn2
Remove afterwards:
ip rule del from table vpn2

Switch to your isp route:

ip rule add from table defgw
Remove afterwards:
ip rule del from table defgw