After long hours of digging and many tries I still cannot figure out how to not have a traffic on a given port going through the openvpn tunnel. Below my setup:
(enp0s25)<ovpn server>(tun0) <--> (tun0)<ovpn client>(enp2s0) <--> app connecting on port 10011
The ovpn server is configured to push the route setup to the client with
push "redirect-gateway def1 bypass-dhcp" so that all the traffic is redirected through the tunnel which is what I want and is working perfectly, except I want the tcp port 10011 not going through the tunnel...
The kernel routing table main of
<ovpn client> is:
0.0.0.0/1 via 192.168.88.9 dev tun0 default via 192.168.0.1 dev enp2s0 220.127.116.11/1 via 192.168.88.9 dev tun0 # not sure why it's there.. 192.168.0.0/24 dev enp2s0 proto kernel scope link src 192.168.0.29 192.168.88.0/24 via 192.168.88.9 dev tun0 192.168.88.9 dev tun0 proto kernel scope link src 192.168.88.10
Here is my latest try on
Define a routing table openvpn
default via 192.168.0.1 dev enp2s0 192.168.0.0/24 dev enp2s0 proto kernel scope link src 192.168.0.29
Define the rule
1000: from all fwmark 0x64 lookup openvpn
Define the following iptables mangle rules:
-A OUTPUT -p tcp -m tcp --sport 10011 -j MARK --set-xmark 0x64/0xffffffff -A OUTPUT -p tcp -m tcp --sport 10011 -j LOG --log-prefix "(OUTPUT) fwmark 100: "
The idea (which might be bad) is to have the
<ovpn client> --> app connecting on port 10011 communications not going back and forth through the tunnel because of the routing table entry
0.0.0.0/1 via 192.168.88.9 dev tun0 but use the routing table openvpn which is a very basic "local network" routing table.
I use mangle OUTPUT because it comes just after the process sends the data on port 10011 and before POSTROUTING so I thought it would be the right chain to use.
When starting openvpn on
<ovpn client> and trying to connect on port 10011 I cannot see any system logs generated by the LOG iptables rule whereas with openvpn stopped I see the logs and everything works fine.
Maybe the source IP of the outgoing traffic to the app is the one of tun0 interface so the routing is broken somewhere..