1

Server with DHCP (iface eth0 172.5.1.1/24) gives internet via openvpn tunnel(iface tun0 10.8.1.6) to lan clients. I need to mark tcp connections from exact lan client, for example 172.5.1.123

iptables -I FORWARD -m conntrack --ctorigsrc 172.5.1.123 --ctproto tcp -j CONNMARK --set-mark 123

While executing on server 172.5.1.1 command conntrack -L --mark 123 i can see all tcp connections from source 172.5.1.123

The question is how to catch connection markers from source ip 172.5.1.123 on vpn server's tunnel interface 10.8.1.1 ?

0

Use iptables mark to match it.

iptables -I FORWARD -m conntrack --ctorigsrc 172.5.1.123 --ctproto tcp -j MARK --set-mark 123

iptables -A PREROUTING -t mangle -m mark --mark 123 -j LOG
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.