Server with DHCP (iface eth0 gives internet via openvpn tunnel(iface tun0 to lan clients. I need to mark tcp connections from exact lan client, for example

iptables -I FORWARD -m conntrack --ctorigsrc --ctproto tcp -j CONNMARK --set-mark 123

While executing on server command conntrack -L --mark 123 i can see all tcp connections from source

The question is how to catch connection markers from source ip on vpn server's tunnel interface ?


Use iptables mark to match it.

iptables -I FORWARD -m conntrack --ctorigsrc --ctproto tcp -j MARK --set-mark 123

iptables -A PREROUTING -t mangle -m mark --mark 123 -j LOG
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.