Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is very similar to what I am trying to do: iptables --set-mark - Route diferent ports through different interfaces However I attempted to follow the answer but I was unable to make it work.

I have one device that I would like to route through a PPTP VPN connection. If I do it on my router it will put all users through the VPN I decided to try and use the same server I am using as a proxy server to connect to the VPN.

I currently have my router (DD-WRT) routing packets to my proxy server using this script:

iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 10
ip rule add fwmark 10 table 10
ip route add default via table 10

That is working fine. On my server end I am trying to route through my VPN and all of the others through my proxy server. I am using the following script on my server:

#Redirect all traffic on 80 to proxy except (WORKING)
iptables -t nat -A PREROUTING -p tcp -m tcp ! -s --dport 80 -j REDIRECT --to-ports 3127
#Mark packets from with 20
iptables -t mangle -A PREROUTING -p tcp -s --dport 80 -j MARK --set-mark 20

I then tried to forward traffic marked with 20 to ppp0 using the following:

ip rule add fwmark 20 table 20
ip route add default via dev ppp0 table 20

All computers can load webpages successfully except for which sits at loading forever. I have confirmed I am getting traffic on ppp0 from using tcpdump -i ppp0

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.