4

I'm playing with iptables and routing.

So I have an Ubuntu machine with 2 interface eth0(192.168.2.100, gw 192.168.2.1) and tun0(10.7.7.2, gw 10.7.7.1).
I want traffic to this site ifconfig.me go via tun0(10.7.7.1) and ipinfo.io via eth0(192.168.2.1)

So I did:

I created new entry in /etc/iproute2/rt_tables:

echo 1 vpn >> /etc/iproute2/rt_tables

Then I added default route to new table:

ip route add default via 10.7.7.1 dev tun0 table vpn

I added rule so all packets with makr 1 are going to be routed via table vpn:

ip rule add fwmark 0x1 table vpn

And I mark all outgoing traffic to ifconfig.me with mark 1:

iptables -A OUTPUT -t mangle -d ifconfig.me -j MARK --set-mark 1

When I do curl to ipinfo.io curl ipinfo.io I get correct IP back, form gateway provided by eth0, but when I try to get a response from ifconfig.me curl ifconfig.me nothing is happening(i think its timing out). So it looks that traffic is going via the correct table but it stops there.

ip route show table vpn:

default via 10.7.7.1 dev tun0
1
  • I think there are easier tools for setting up routing: They may in the end configure iptables, but are much easier to use. Commented Nov 5, 2018 at 10:42

1 Answer 1

3

You don't need all this mess, routing is destination and gateway based, so if you want some trafic to go thru some interface all you need is to ... set the route correctly:

# ifconfig thru vpn link
ip route add 153.121.72.212 via 10.7.7.1
ip route add 153.121.72.211 via 10.7.7.1
# everything else via default network
ip route add default via 192.168.2.1
2
  • Thanks for your reply. I would really like to know, how can I use marked packets to make the routing decision.
    – James
    Commented Nov 5, 2018 at 13:07
  • For that I think you need to mark packet in PREROUTING chain, OUTPUT is too "late"
    – silmaril
    Commented Feb 8, 2019 at 10:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .