1

After long hours of digging and many tries I still cannot figure out how to not have a traffic on a given port going through the openvpn tunnel. Below my setup:

(enp0s25)<ovpn server>(tun0) <--> (tun0)<ovpn client>(enp2s0) <--> app connecting on port 10011

The ovpn server is configured to push the route setup to the client with push "redirect-gateway def1 bypass-dhcp" so that all the traffic is redirected through the tunnel which is what I want and is working perfectly, except I want the tcp port 10011 not going through the tunnel...

The kernel routing table main of <ovpn client> is:

0.0.0.0/1 via 192.168.88.9 dev tun0
default via 192.168.0.1 dev enp2s0
128.0.0.0/1 via 192.168.88.9 dev tun0  # not sure why it's there..
192.168.0.0/24 dev enp2s0  proto kernel  scope link  src 192.168.0.29
192.168.88.0/24 via 192.168.88.9 dev tun0
192.168.88.9 dev tun0  proto kernel  scope link  src 192.168.88.10

Here is my latest try on <ovpn client>:

  1. Define a routing table openvpn

    default via 192.168.0.1 dev enp2s0
    192.168.0.0/24 dev enp2s0  proto kernel  scope link  src 192.168.0.29
    
  2. Define the rule 1000: from all fwmark 0x64 lookup openvpn

  3. Define the following iptables mangle rules:

    -A OUTPUT -p tcp -m tcp --sport 10011 -j MARK --set-xmark 0x64/0xffffffff
    -A OUTPUT -p tcp -m tcp --sport 10011 -j LOG --log-prefix "(OUTPUT) fwmark 100: "
    

The idea (which might be bad) is to have the <ovpn client> --> app connecting on port 10011 communications not going back and forth through the tunnel because of the routing table entry 0.0.0.0/1 via 192.168.88.9 dev tun0 but use the routing table openvpn which is a very basic "local network" routing table.

I use mangle OUTPUT because it comes just after the process sends the data on port 10011 and before POSTROUTING so I thought it would be the right chain to use.

When starting openvpn on <ovpn client> and trying to connect on port 10011 I cannot see any system logs generated by the LOG iptables rule whereas with openvpn stopped I see the logs and everything works fine.

Maybe the source IP of the outgoing traffic to the app is the one of tun0 interface so the routing is broken somewhere..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.