1

Server with DHCP (iface eth0 172.5.1.1/24) gives internet via openvpn tunnel(iface tun0 10.8.1.6) to lan clients. I need to mark tcp connections from exact lan client, for example 172.5.1.123

iptables -I FORWARD -m conntrack --ctorigsrc 172.5.1.123 --ctproto tcp -j CONNMARK --set-mark 123

While executing on server 172.5.1.1 command conntrack -L --mark 123 i can see all tcp connections from source 172.5.1.123

The question is how to catch connection markers from source ip 172.5.1.123 on vpn server's tunnel interface 10.8.1.1 ?

  • A packet mark is internal to the server. It's virtual, and never goes on the wire (even a virtual wire...). If 10.8.1.1 isn't the same server (but the peer server) then you can't do this with only netfilter and iptables. There's conntrackd used to synchronize two firewalls (see conntrack-tools.netfilter.org/manual.html#sync see especially step 2.: dedicated link, in this case not through the same VPN or at least with some CT --notrack rules to avoid some packet storm loop ). But that's neither really what you have. Perhaps with some tweaking... – A.B Feb 5 '18 at 23:17
0

Use iptables mark to match it.

iptables -I FORWARD -m conntrack --ctorigsrc 172.5.1.123 --ctproto tcp -j MARK --set-mark 123

iptables -A PREROUTING -t mangle -m mark --mark 123 -j LOG

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.