I use ubuntu. The only apps I have in it are firefox and telegram, both downloaded through official channels. I use other apps with virtualization, so my main machine is mostly clean.

I use a VPN so everything goes to it through a tun interface. Here's my route -n output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    50     0        0 tun0         UG    600    0        0 wlp1s0   U     50     0        0 tun0     U     1000   0        0 virbr0   U     600    0        0 wlp1s0 UH    600    0        0 wlp1s0   U     0      0        0 virbr0 UGH   600    0        0 wlp1s0

I noticed this strange IP which connects directly through my gateway, thus bypassing my VPN. The other bypasses were made by me using ufw: I added bypasses to so I can access my local network

I don't know how it got there, but I had a cron job that bypasses by proton VPN for a dynamic IP, which is given by a domain name:

Current_IP=$(host $HOSTNAME | head -n1 | cut -f4 -d ' ')

if [ ! -f $LOGFILE ]; then
    /usr/sbin/ufw allow from any to $Current_IP port 1194 proto udp
    echo $Current_IP > $LOGFILE

    Old_IP=$(cat $LOGFILE)
    if [ "$Current_IP" = "$Old_IP" ] ; then
        echo IP address has not changed
        /usr/sbin/ufw delete allow from any to $Old_IP port 1194 proto udp
        /usr/sbin/ufw allow from any to $Current_IP port 1194 proto udp
        echo $Current_IP > $LOGFILE
        echo iptables have been updated

I thought the strange IP had something to do with this cron job. But I don't think my.domain.com ever had this IP. I don't even think this cron job alters routes. And I also think that I don't even know what this cron job is doing now that I'm looking better at it.

A simple google search on this IP gives one result of an user on reddit talking about Proton VPN, which is the VPN provider I use. But the post is gone now.

Does anybody have any idea of what is happening?


here's the reddit cache: http://webcache.googleusercontent.com/search?q=cache:46CfMx_bnzQJ:https://www.reddit.com/r/ProtonVPN/comments/8s40e5/pfconf_configuration_for_protonvpn_macos_app/&num=1&hl=en&gl=uk&strip=1&vwsrc=0

I also didn't install anything from proton VPN, I use only open VPN with proton VPN configuration files

1 Answer 1


I think I found what's happening everytime I change my VPN connection to another country, this specific IP changes. Of course, it's the open VPN app making an out connection to the server so the connection doesn't go through the tun device for the open vpn client

  • This is absolutely correct. When you change default gateway to the tunnel, you still need a route to the VPN server. As the post specific route generally wins, this works. This also means that any other traffic (e.g. http) to this host will follow this route.
    – vidarlo
    Jul 17, 2018 at 4:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .