Server with DHCP (iface eth0 gives internet via openvpn tunnel(iface tun0 to lan clients. I need to mark tcp connections from exact lan client, for example

iptables -I FORWARD -m conntrack --ctorigsrc --ctproto tcp -j CONNMARK --set-mark 123

While executing on server command conntrack -L --mark 123 i can see all tcp connections from source

The question is how to catch connection markers from source ip on vpn server's tunnel interface ?

  • A packet mark is internal to the server. It's virtual, and never goes on the wire (even a virtual wire...). If isn't the same server (but the peer server) then you can't do this with only netfilter and iptables. There's conntrackd used to synchronize two firewalls (see conntrack-tools.netfilter.org/manual.html#sync see especially step 2.: dedicated link, in this case not through the same VPN or at least with some CT --notrack rules to avoid some packet storm loop ). But that's neither really what you have. Perhaps with some tweaking... – A.B Feb 5 '18 at 23:17

Use iptables mark to match it.

iptables -I FORWARD -m conntrack --ctorigsrc --ctproto tcp -j MARK --set-mark 123

iptables -A PREROUTING -t mangle -m mark --mark 123 -j LOG

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.