1

Server with DHCP (iface eth0 172.5.1.1/24) gives internet via openvpn tunnel(iface tun0 10.8.1.6) to lan clients. I need to mark tcp connections from exact lan client, for example 172.5.1.123

iptables -I FORWARD -m conntrack --ctorigsrc 172.5.1.123 --ctproto tcp -j CONNMARK --set-mark 123

While executing on server 172.5.1.1 command conntrack -L --mark 123 i can see all tcp connections from source 172.5.1.123

The question is how to catch connection markers from source ip 172.5.1.123 on vpn server's tunnel interface 10.8.1.1 ?

0

1 Answer 1

0

Use iptables mark to match it.

iptables -I FORWARD -m conntrack --ctorigsrc 172.5.1.123 --ctproto tcp -j MARK --set-mark 123

iptables -A PREROUTING -t mangle -m mark --mark 123 -j LOG

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .