0

I have not been able to find out how to do this.

I have a vpn access point which uses openconnect and hostapd with the following vpn iptables rules

pi@raspberrypi:~ $ cat /etc/iptables.ipv4.vpn.nat
# Generated by iptables-save v1.4.21 on Sun Sep  4 02:28:21 2016
*filter
:INPUT ACCEPT [2:152]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2:152] 
-A FORWARD -i tun0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan1 -o tun0 -j ACCEPT
COMMIT
# Completed on Sun Sep  4 02:28:21 2016 
# Generated by iptables-save v1.4.21 on Sun Sep  4 02:28:21 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [5:380]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
# Completed on Sun Sep  4 02:28:21 2016

and the following non vpn'd access point

# Generated by iptables-save v1.4.21 on Sun Sep  4 02:28:21 2016
*filter
:INPUT ACCEPT [2:152]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2:152]
-A FORWARD -i wlan1 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i wlan0 -o wlan1 -j ACCEPT
COMMIT
# Completed on Sun Sep  4 02:28:21 2016
# Generated by iptables-save v1.4.21 on Sun Sep  4 02:28:21 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [5:380] 
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o wlan1 -j MASQUERADE
COMMIT
# Completed on Sun Sep  4 02:28:21 2016

There are a few IP's that are not accessible from within the VPN so what I want to do is send all traffic through the vpn except for x.x.x.x and x.x.x.y for instance. For that traffic I just want it regularly nat'd so I can access it through the access point but not through the vpn.

Any idea how I can do this?

0

You're overthinking the problem.

Consider the two gateways for the two interfaces (the gateways, not the IP addresses for the interfaces themselves)

gweth0=192.168.1.254
gwtun0=10.1.1.1

You can route these like this

route add default gw $gwtun0
route add -host x.x.x.x gw $gweth0
route add -host x.x.x.y gw $gweth0

You can even route entire subnets

route add -net a.b.c.d/24 gw $gweth0

The iptables ... MASQUERADE stuff is only required if you need to rewrite the IP addresses. From a single client that's unlikely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.