iptables port forwarding and forcing interface on port

Question

DDWRT is running a VPN client daemon (interface tun1) and all traffic, with a couple of exceptions gets routed through that interface.

The first exception is traffic on port 12600 should be routed through vlan2, which is the regular non-vpned internet connection. This allows me to SSH into my router when out from home.

# Create table 202 via the Gateway Ip on the Interface VLAN2
ip route add default via $(nvram get wan_gateway) dev vlan2 table 202
# Apply the rule on table 202 to packages marked with 22
ip rule add fwmark 22 table 202
# Tag with 22 every output package on port 12600 not coming from any machine in the local network
iptables -t mangle -I OUTPUT -p tcp --sport 12600 -d ! 192.168.1.0/24 -j MARK --set-mark 22

That is working like charm :-)

Now, the second issue is to forward port 16001 to my Raspberry PI (Local IP 192.168.1.132) and also route that traffic through the vlan2 interface and not tun1.

The forwarding part is working:

iptables -t nat -I PREROUTING -p tcp --dport 12601 -j DNAT --to 192.168.`.132:12601
iptables -I FORWARD -i vlan2 -d 192.168.1.132 -p tcp --dport 12601 -j ACCEPT

At this point, if I deactivate the OpenVPN daemon on the router, SSH into the RPI is working. The problem is that when the daemon is active, the packages get to the RPI through the vlan2 interface as expected, the RPI sends the response back, it gets routed through tun1, making SSH impossible.

I tried adding the rule:

iptables -t mangle -I OUTPUT -p tcp -s 192.168.1.132 -j MARK --set-mark 22

But that hasn't worked. I see that no packages are being marked with that rule.

Someone pointed to the rp_filter, but mines are all set to 0 (it must be the default value for DD-WRT because I haven't modified it):

root@DD-WRT:~# sysctl -a | grep \\.rp_filter
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.br0.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth1.rp_filter = 0
net.ipv4.conf.eth2.rp_filter = 0
net.ipv4.conf.imq0.rp_filter = 0
net.ipv4.conf.imq1.rp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.teql0.rp_filter = 0
net.ipv4.conf.tun1.rp_filter = 0
net.ipv4.conf.vlan1.rp_filter = 0
net.ipv4.conf.vlan2.rp_filter = 0

These are my iptables:

root@DD-WRT:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 183 packets, 30508 bytes)
 pkts bytes target     prot opt in     out     source               destination
    4   256 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:12601 to:192.168.1.132:12601
   53  3644 DNAT       udp  --  br0    *       0.0.0.0/0            0.0.0.0/0           udp dpt:53 to:192.168.1.1
    0     0 DNAT       tcp  --  br0    *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53 to:192.168.1.1
    0     0 DROP       tcp  --  *      *       192.168.1.1          192.168.1.1         tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       192.168.1.0/24       192.168.1.1         tcp dpt:443
    3   180 DNAT       tcp  --  *      *       0.0.0.0/0           !73.93.100.100       tcp dpt:80 to:192.168.1.1:8118
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            73.93.100.100       tcp dpt:8080 to:192.168.1.1:443
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            73.93.100.100       tcp dpt:12600 to:192.168.1.1:12600
    0     0 DNAT       icmp --  *      *       0.0.0.0/0            73.93.100.100       to:192.168.1.1
  126 21928 TRIGGER    0    --  *      *       0.0.0.0/0            73.93.100.100       TRIGGER type:dnat match:0 relate:0

Chain INPUT (policy ACCEPT 11131 packets, 732K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 60 packets, 6022 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 23 packets, 4522 bytes)
 pkts bytes target     prot opt in     out     source               destination
   92  9920 MASQUERADE  0    --  *      tun1    0.0.0.0/0            0.0.0.0/0
    2   120 SNAT       0    --  *      vlan2   192.168.1.0/24       0.0.0.0/0           to:73.93.100.100



root@DD-WRT:~# iptables -vnL -t mangle
Chain PREROUTING (policy ACCEPT 1787 packets, 398K bytes)
 pkts bytes target     prot opt in     out     source               destination
 1787  398K FILTER_IN  0    --  *      *       0.0.0.0/0            0.0.0.0/0
  385  101K VPN_IN     0    --  tun+   *       0.0.0.0/0            0.0.0.0/0

Chain INPUT (policy ACCEPT 529K packets, 462M bytes)
 pkts bytes target     prot opt in     out     source               destination
   53  7298 IMQ        0    --  tun+   *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 0
  559  161K IMQ        0    --  vlan2  *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 0
  293 35826 IMQ        0    --  !vlan2 *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 1

Chain FORWARD (policy ACCEPT 487K packets, 318M bytes)
 pkts bytes target     prot opt in     out     source               destination
  332 94003 IMQ        0    --  tun+   *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 0
   98  5984 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU
   39  6701 IMQ        0    --  vlan2  *       0.0.0.0/0            0.0.0.0/0           IMQ: todev 0
  918  204K IMQ        0    --  !vlan2 !vlan2  0.0.0.0/0            0.0.0.0/0           IMQ: todev 1

Chain OUTPUT (policy ACCEPT 823 packets, 196K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MARK       tcp  --  *      *       0.0.0.0/0           !192.168.1.0/24      tcp spt:12600  MARK set 0x16
   21 16378 IMQ        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:8118 IMQ: todev 0
    0     0 MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:12601  MARK set 0x16

Chain POSTROUTING (policy ACCEPT 928K packets, 531M bytes)
 pkts bytes target     prot opt in     out     source               destination
  525 89419 VPN_OUT    0    --  *      tun+    0.0.0.0/0            0.0.0.0/0
 1827  412K FILTER_OUT  0    --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 DSCP       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match !0x00 DSCP set 0x00

Chain FILTER_IN (1 references)
 pkts bytes target     prot opt in     out     source               destination
 1787  398K CONNMARK   0    --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK restore
 1413  324K SVQOS_SVCS  0    --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0x7ffc00
 1787  398K CONNMARK   0    --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK save
 1787  398K RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FILTER_OUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
 1827  412K CONNMARK   0    --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK restore
 1488  328K SVQOS_SVCS  0    --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x0/0x7ffc00
 1827  412K VPN_DSCP   0    --  *      *       0.0.0.0/0            0.0.0.0/0
 1827  412K CONNMARK   0    --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK save
 1827  412K RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain SVQOS_SVCS (2 references)
 pkts bytes target     prot opt in     out     source               destination
 2901  653K RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain VPN_DSCP (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MARK       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match 0x0a  MARK xset 0x19000/0x7ffc00
    0     0 MARK       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match 0x01  MARK xset 0x2800/0x7ffc00
  126 32463 MARK       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match 0x02  MARK xset 0x5000/0x7ffc00
    0     0 MARK       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match 0x03  MARK xset 0x7800/0x7ffc00
   77 20422 MARK       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match 0x04  MARK xset 0xa000/0x7ffc00
  313 73735 DSCP       0    --  *      *       0.0.0.0/0            0.0.0.0/0           DSCP match !0x00 DSCP set 0x00
 1827  412K RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain VPN_IN (1 references)
 pkts bytes target     prot opt in     out     source               destination
  385  101K CONNMARK   0    --  *      *       0.0.0.0/0            0.0.0.0/0           CONNMARK save

Chain VPN_OUT (1 references)
 pkts bytes target     prot opt in     out     source               destination




root@DD-WRT:~# iptables -vnL -t filter
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   95 20753 ACCEPT     0    --  tun1   *       0.0.0.0/0            0.0.0.0/0
  864  291K ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     udp  --  vlan2  *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68
    0     0 ACCEPT     udp  --  vlan2  *       0.0.0.0/0            0.0.0.0/0           udp dpt:520
    0     0 DROP       udp  --  br0    *       0.0.0.0/0            0.0.0.0/0           udp dpt:520
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:520
  146 12000 ACCEPT     0    --  br0    *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.1         tcp dpt:443
    0     0 logbrute   tcp  --  vlan2  *       0.0.0.0/0            192.168.1.1         tcp dpt:12600
    0     0 ACCEPT     tcp  --  vlan2  *       0.0.0.0/0            192.168.1.1         tcp dpt:12600
    0     0 DROP       icmp --  vlan2  *       0.0.0.0/0            0.0.0.0/0
    0     0 DROP       2    --  *      *       0.0.0.0/0            0.0.0.0/0
    4   293 ACCEPT     0    --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW
    0     0 ACCEPT     0    --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW
  162 27477 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  731  143K ACCEPT     0    --  *      tun1    0.0.0.0/0            0.0.0.0/0
  544  189K ACCEPT     0    --  tun1   *       0.0.0.0/0            0.0.0.0/0
   11   688 ACCEPT     tcp  --  vlan2  *       0.0.0.0/0            192.168.1.132       tcp dpt:12601
   86 12596 ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
  158 37906 lan2wan    0    --  *      *       0.0.0.0/0            0.0.0.0/0
  156 37786 ACCEPT     0    --  br0    br0     0.0.0.0/0            0.0.0.0/0
    2   120 ACCEPT     0    --  br0    vlan2   0.0.0.0/0            0.0.0.0/0
    0     0 DROP       tcp  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           tcp dpt:1723
    0     0 DROP       udp  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           udp dpt:1701
    0     0 DROP       udp  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           udp dpt:500
    0     0 TRIGGER    0    --  vlan2  br0     0.0.0.0/0            0.0.0.0/0           TRIGGER type:in match:0 relate:0
    0     0 trigger_out  0    --  br0    *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     0    --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW
    0     0 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0

With tcpdump I can see that inbound traffic towards RPI on port 12601 is making it through vlan2 but outbound traffic is routed on tun1:

root@DD-WRT:~# tcpdump -n -i vlan2 port 12601
listening on vlan2, link-type EN10MB (Ethernet), capture size 65535 bytes
20:49:19.983896 IP 208.54.5.222.47184 > 73.93.100.100.12601: Flags [S], seq 1024682508, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 336905559 ecr 0,sackOK,eol], length 0
20:49:21.055561 IP 208.54.5.222.47184 > 73.93.100.100.12601: Flags [S], seq 1024682508, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 336906559 ecr 0,sackOK,eol], length 0
20:49:22.092159 IP 208.54.5.222.47184 > 73.93.100.100.12601: Flags [S], seq 1024682508, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 336907559 ecr 0,sackOK,eol], length 0
20:49:23.055189 IP 208.54.5.222.47184 > 73.93.100.100.12601: Flags [S], seq 1024682508, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 336908559 ecr 0,sackOK,eol], length 0

root@DD-WRT:~# tcpdump -n -i tun1 port 12601
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
20:49:37.052293 IP 73.93.100.100.12601 > 208.54.5.222.47184: Flags [S.], seq 3536123446, ack 1024682509, win 28960, options [mss 1460,sackOK,TS val 2958399 ecr 336905559,nop,wscale 7], length 0
20:49:38.062308 IP 73.93.100.100.12601 > 208.54.5.222.59028: Flags [S.], seq 2196420762, ack 1024682509, win 28960, options [mss 1460,sackOK,TS val 2958500 ecr 336916559,nop,wscale 7], length 0
20:49:38.995709 IP 73.93.100.100.12601 > 208.54.5.222.41591: Flags [S.], seq 4130650631, ack 1024682509, win 28960, options [mss 1460,sackOK,TS val 2958593 ecr 336924559,nop,wscale 7], length 0

3 packets captured
3 packets received by filter
0 packets dropped by kernel

AFAIK this can't be done with iptables alone, you need iproute2 to be able to control the routing decision: linuxmonk.ch/wordpress/index.php/2016/… — DepressedDaniel, Dec 30 '16 at 5:07

tokenizer_fsj · Accepted Answer · 2017-01-02 18:44:10Z

Got it working. It appears that iptables changes, even after a ip route flush cache won't take place until the DD-WRT refreshes; by refresh I mean restart all the main services, what happens after you change some settings and click on Apply Changes.

For reference, I wanted to be able to SSH into my Raspberry Pi from an external network. The RPI is connected to a DD-WRT router that is running OpenVPN as a client. DD-WRT needs to forward port 12601 (SSH) to the RPI, and avoid sending the response packages through the VPN interface tun1 (default) as the packages are coming through the internet gateway vlan2.

This is how my firewall script looks like:

# Create a rule to skip the VPN
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter  
iptables -t mangle -F PREROUTING  
ip route add default table 200 via $(nvram get wan_gateway)  
ip rule add fwmark 1 table 200  
ip route flush cache

## SSH to RPI (port 12601)
# First the port forwarding part
iptables -t nat -I PREROUTING -p tcp --dport 12601 -j DNAT --to 192.168.4.132:12601
iptables -I FORWARD -i vlan2 -d 192.168.1.132 -p tcp --dport 12601 -j ACCEPT
# Now mark packages from RPI and source port 12601 with tag 1. The rule above will direct packages marked with 1 through the wan gateway
iptables -t mangle -I PREROUTING -i br0 -p tcp -s 192.168.1.132 --sport 12601 -j MARK --set-mark 1

asked	2 years, 5 months ago
viewed	489 times
active	2 months ago

Stack Exchange Network

current community

your communities

more stack exchange communities

iptables port forwarding and forcing interface on port

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged iptables or ask your own question.

Hot Network Questions

iptables port forwarding and forcing interface on port

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged iptables or ask your own question.

Related

Hot Network Questions