After long hours of digging and many tries I still cannot figure out how to not have a traffic on a given port going through the openvpn tunnel. Below my setup:

(enp0s25)<ovpn server>(tun0) <--> (tun0)<ovpn client>(enp2s0) <--> app connecting on port 10011

The ovpn server is configured to push the route setup to the client with push "redirect-gateway def1 bypass-dhcp" so that all the traffic is redirected through the tunnel which is what I want and is working perfectly, except I want the tcp port 10011 not going through the tunnel...

The kernel routing table main of <ovpn client> is: via dev tun0
default via dev enp2s0 via dev tun0  # not sure why it's there.. dev enp2s0  proto kernel  scope link  src via dev tun0 dev tun0  proto kernel  scope link  src

Here is my latest try on <ovpn client>:

  1. Define a routing table openvpn

    default via dev enp2s0 dev enp2s0  proto kernel  scope link  src
  2. Define the rule 1000: from all fwmark 0x64 lookup openvpn

  3. Define the following iptables mangle rules:

    -A OUTPUT -p tcp -m tcp --sport 10011 -j MARK --set-xmark 0x64/0xffffffff
    -A OUTPUT -p tcp -m tcp --sport 10011 -j LOG --log-prefix "(OUTPUT) fwmark 100: "

The idea (which might be bad) is to have the <ovpn client> --> app connecting on port 10011 communications not going back and forth through the tunnel because of the routing table entry via dev tun0 but use the routing table openvpn which is a very basic "local network" routing table.

I use mangle OUTPUT because it comes just after the process sends the data on port 10011 and before POSTROUTING so I thought it would be the right chain to use.

When starting openvpn on <ovpn client> and trying to connect on port 10011 I cannot see any system logs generated by the LOG iptables rule whereas with openvpn stopped I see the logs and everything works fine.

Maybe the source IP of the outgoing traffic to the app is the one of tun0 interface so the routing is broken somewhere..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.