Server with DHCP (iface eth0 gives internet via openvpn tunnel(iface tun0 to lan clients. I need to mark tcp connections from exact lan client, for example

iptables -I FORWARD -m conntrack --ctorigsrc --ctproto tcp -j CONNMARK --set-mark 123

While executing on server command conntrack -L --mark 123 i can see all tcp connections from source

The question is how to catch connection markers from source ip on vpn server's tunnel interface ?


1 Answer 1


Use iptables mark to match it.

iptables -I FORWARD -m conntrack --ctorigsrc --ctproto tcp -j MARK --set-mark 123

iptables -A PREROUTING -t mangle -m mark --mark 123 -j LOG

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .