I'm playing with iptables and routing.

So I have an Ubuntu machine with 2 interface eth0(, gw and tun0(, gw
I want traffic to this site ifconfig.me go via tun0( and ipinfo.io via eth0(

So I did:

I created new entry in /etc/iproute2/rt_tables:

echo 1 vpn >> /etc/iproute2/rt_tables

Then I added default route to new table:

ip route add default via dev tun0 table vpn

I added rule so all packets with makr 1 are going to be routed via table vpn:

ip rule add fwmark 0x1 table vpn

And I mark all outgoing traffic to ifconfig.me with mark 1:

iptables -A OUTPUT -t mangle -d ifconfig.me -j MARK --set-mark 1

When I do curl to ipinfo.io curl ipinfo.io I get correct IP back, form gateway provided by eth0, but when I try to get a response from ifconfig.me curl ifconfig.me nothing is happening(i think its timing out). So it looks that traffic is going via the correct table but it stops there.

ip route show table vpn:

default via dev tun0
  • I think there are easier tools for setting up routing: They may in the end configure iptables, but are much easier to use. Nov 5 '18 at 10:42

You don't need all this mess, routing is destination and gateway based, so if you want some trafic to go thru some interface all you need is to ... set the route correctly:

# ifconfig thru vpn link
ip route add via
ip route add via
# everything else via default network
ip route add default via
  • Thanks for your reply. I would really like to know, how can I use marked packets to make the routing decision.
    – James
    Nov 5 '18 at 13:07
  • For that I think you need to mark packet in PREROUTING chain, OUTPUT is too "late"
    – silmaril
    Feb 8 '19 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.