I have a linux based router and have a vpn client set up to route traffic through the vpn and isp per iptables commands i am attempting to route specific tcp and all udp ports through the vpn only and using tcpdump to verify but i cant seem to get it working here is the code i have been using

iptables -t mangle -A PREROUTING -i br0 -p tcp -m multiport --dport ! 20,21,22,80,81,443,8080 -j MARK --set-mark 2

iptables -t mangle -A PREROUTING -i br0 -p udp -j MARK --set-mark 2

where "2" is the VPN table (in my case table 10) and where "1" ISP table (table 100)

the script has other routing related functions that works properly in reguard to moving specific ip's to the vpn and a kill switch

the concept is I am attempting to run a torrent client off of the router itself (internal "lan" and I want all udp and every tcp port that is NOT listed above to use the vpn while the rest goes through the isp

i have been told i may need to use the INPUT OUTPUT AND FORWARD options as well but despite reading I cant seem to get the ports to route properly, my script either ends up hanging and crashing the router or i end up with no traffic at all to the internet via vpn or the isp

here is my script without the ports section as i removed it out of fustiration


main() {

for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
  echo 0 > $i

ip route flush table 100

ip rule del fwmark 1 table 100

ip route del default table 100

ip rule del fwmark 2 table 10

ip route flush cache

iptables -t mangle -F INPUT

iptables -t mangle -F OUTPUT

iptables -t mangle -F FORWARD

iptables -t mangle -F PREROUTING

iptables -t mangle -F POSTROUTING

iptables -t mangle -F

ip route show table main | grep ^default | grep -Ev tun1 \
  | while read ROUTE ; do
      ip route add table 100 $ROUTE

ip route add default table 100 via 
$(nvram get wan_gateway)

ip rule add fwmark 1 table 100

ip rule add fwmark 2 table 10

ip route flush cache

int() {
iptables -t mangle -A PREROUTING -i "$1" -j MARK --set-mark 1

adr() {
iptables -t mangle -A PREROUTING -i br0 -s "$1" -j MARK --set-mark 2

kills() {
iptables -I FORWARD -s "$1" -o eth0 -j DROP


int br0







exit 0

I have my router set up where it defaults to trafficing through the isp not the vpn


One key for understanding this is the point that the packets to or from the router host take a different path through iptables than those going through the router. You can google iptables-chains.png and follow up on some images, e.g., http://jensd.be/wp-content/uploads/iptables_chains.png .

The overview picture at http://www.linuxjournal.com/files/linuxjournal.com/ufiles/imagecache/large-550px-centered/u1002061/10822f1.png is also quite helpful for making iptables rules.

Specifically, the PREROUTING chain of the mangle table only applies to incoming packets, which is fine for forwarded packets (remote-to-remote) whereas you want to direct the outgoing packets for the router's local-to-remote traffic. Thus, your initial rule settings above should be for the OUTPUT chain of the mangle table in order to direct the local-to-remote traffic.

  • lol I feel silly now but those diagrams helped, could help explain why my latter rules regarding p2p keep going through the isp not the vpn lol – Cyrus Wolf Jun 20 '16 at 5:19
  • so I edited the script with the iptables -t mangle OUTPUT but now the ip's traveling through the vpn dont connect – Cyrus Wolf Jun 20 '16 at 20:41
  • Yes, the OUTPUT traffic of course includes the VPN traffic, and you'll need to avoid marking that; perhaps by recognizing (avoiding) the remote VPN ip+port. – Ralph Rönnquist Jun 21 '16 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.