Confusions:
- It's not just TCP packets flowing through
tun0. It could be UDP and ICMP too. - UDP is the protocol that encapsulates your OpenVPN traffic
Question answers:
- The
54.202.18.143 ... eth0line is your default route. This is where any traffic that does not match a better routing rule will be sent.This is an explicit route to the VPN gateway (the
255.255.255.255ensure that54.202.18.143matches exactly that one IP address: nothing more and nothing less):54.202.18.143 10.0.2.2 255.255.255.255 UGH 0 0 0 eth0I assume that
10.0.2.2is your LAN router, so this is telling your client that all traffic for the VPN endpoint is to be sent out viaeth0to your router (and onward). This ensures that because your pseudo-default route has been updated to send all traffic via your VPN, the encapsulated packets themselves don't get routed through the VPN too. (Like a snake eating its tail, this is not a good situation to be in.)The pseudo-default route is built from these two lines:
0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0 128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0These have a higher priority than your real default route but lower than priority than any other lines in your routing table. Together they match all traffic except that which matches other lines in your routing table.
- All packets except the OpenVPN UDP encapsulation traffic will go through tun0
All packets except the OpenVPN UDP encapsulation traffic will go through tun0
- Only the OpenVPN UDP encapsulation traffic will go via 54.202.18.143.
Only the OpenVPN UDP encapsulation traffic will go via 54.202.18.143.