1

I'm playing with iptables and routing.

So I have an Ubuntu machine with 2 interface eth0(192.168.2.100, gw 192.168.2.1) and tun0(10.7.7.2, gw 10.7.7.1).
I want traffic to this site ifconfig.me go via tun0(10.7.7.1) and ipinfo.io via eth0(192.168.2.1)

So I did:

I created new entry in /etc/iproute2/rt_tables
echo 1 vpn >> /etc/iproute2/rt_tables

Then I added default route to new table
ip route add default via 10.7.7.1 dev tun0 table vpn

I added rule so all packets with makr 1 are going to be routed via table vpn
ip rule add fwmark 0x1 table vpn

And I mark all outgoing traffic to ifconfig.me with mark 1
iptables -A OUTPUT -t mangle -d ifconfig.me -j MARK --set-mark 1

When I do curl to ipinfo.io curl ipinfo.io I get correct IP back, form gateway provided by eth0, but when I try to get a response from ifconfig.me curl ifconfig.me nothing is happening(i think its timing out). So it looks that traffic is going via the correct table but it stops there.

ip route show table vpn:
default via 10.7.7.1 dev tun0

  • I think there are easier tools for setting up routing: They may in the end configure iptables, but are much easier to use. – ctrl-alt-delor Nov 5 '18 at 10:42
2

You don't need all this mess, routing is destination and gateway based, so if you want some trafic to go thru some interface all you need is to ... set the route correctly:

# ifconfig thru vpn link
ip route add 153.121.72.212 via 10.7.7.1
ip route add 153.121.72.211 via 10.7.7.1
# everything else via default network
ip route add default via 192.168.2.1
  • Thanks for your reply. I would really like to know, how can I use marked packets to make the routing decision. – James Nov 5 '18 at 13:07
  • For that I think you need to mark packet in PREROUTING chain, OUTPUT is too "late" – silmaril Feb 8 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.