1

I'm trying to tweak my setup so that I can route all traffic from one of my user accounts via a VPN connection. So far I haven't been able to achieve this.

OS: Fedora27

When connected to the VPN via network manager GUI (all traffic goes through the VPN, the VPN works). $ip route:

default via 10.5.0.1 dev tun0 proto static metric 50 
default via 192.168.0.1 dev enp0s3 proto static metric 100 
192.168.0.0/24 dev enp0s3 proto kernel scope link src 192.168.0.15 metric 100 
10.5.0.0/16 dev tun0 proto kernel scope link src 10.5.1.112 metric 50 
$VPNIP via 192.168.0.1 dev enp0s3 proto static metric 100

Steps I've taken (note replaced VPN IP with $VPNIP for this post):

  1. Create second user account $user2 (UID 1001)

  2. Create second routing table:

    echo 100 vpn >> /etc/iproute2/rt_tables

  3. Set default routing table to not forward all traffic through VPN:

    nmcli connection modify VPN ipv4.never-default true

  4. Set iptables to mark packets from $user2:

    *nat
    :PREROUTING ACCEPT [0:0]
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [3:180]
    :POSTROUTING ACCEPT [3:180]
    -A POSTROUTING -m mark --mark 0xb -j MASQUERADE
    COMMIT

    *mangle
    :PREROUTING ACCEPT [903:366886]
    :INPUT ACCEPT [903:366886]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [872:617897]
    :POSTROUTING ACCEPT [872:617897]
    -A OUTPUT -m owner --uid-owner 1001 -j MARK --set-xmark 0xb/0xffffffff
    COMMIT

    *filter
    :INPUT DROP [0:0]
    :FORWARD DROP [0:0]
    :OUTPUT DROP [0:0]
    # allow lo
    -A INPUT -i lo -j ACCEPT
    -A OUTPUT -o lo -j ACCEPT
    # allow established
    -A INPUT -m state --state ESTABLISHED -j ACCEPT
    # allow vpn
    -A OUTPUT -m owner --uid-owner 0 -d $VPNIP -p tcp --dport 443 -j ACCEPT
    # allow vpn dns
    -A OUTPUT -o tun0 -m owner --uid-owner 0 -d 10.5.0.1 -p udp --dport 53 -j ACCEPT
    -A OUTPUT -o tun0 -m owner --uid-owner 1001 10.5.0.1 -p udp --dport 53 -j ACCEPT
    # allow vpn http
    -A OUTPUT -o tun0 -m owner --uid-owner 1001 -p tcp --dport 80 -j ACCEPT
    -A OUTPUT -o tun0 -m owner --uid-owner 1001 -p tcp --dport 443 -j ACCEPT
    # allow ssh
    -A INPUT -i enp0s3 -p tcp --dport 22 -j ACCEPT
    -A OUTPUT -o enp0s3 -p tcp --sport 22 -j ACCEPT
    COMMIT

  5. Add ip rule to set marked packets to route through table 100:

    ip rule add fwmark 11 table 100

  6. Copy all lines of working default route to table 100:

    ip route add default via 10.5.0.1 dev tun0 proto static metric 50 table 100 ip route add default via 192.168.0.1 dev enp0s3 proto static metric 100 table 100 ip route add 192.168.0.0/24 dev enp0s3 proto kernel scope link src 192.168.0.15 metric 100 table 100 ip route add 10.5.0.0/16 dev tun0 proto kernel scope link src 10.5.1.112 metric 50 table 100 ip route add $VPNIP via 192.168.0.1 dev enp0s3 proto static metric 100 table 100

Problems: It doesn't work, and the routes don't seem to persist, any help much appreciated!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.