I have a bridge network br0 that has the IP 10.0.0.1/24, I have a client connected with the IP 10.0.0.2 to it. I also have a VPN connection (tun0) that has an IP assigned by an DHCP, so it's IP may vary. The VPN connection is not the default route of the system, therefore all the traffic on the device goes trough the regular eth0 route (Not the VPN one). (IPv4 forwarding is enabled on the host)
What I'm trying to achieve is that any client that is connected to br0 (In my case an LXC container) with the gateway set to 10.0.0.1 should have it's traffic NATed and routed trough the VPN connetion.
As it is not possible to directly attach the tun0 device to br0, I tried to get the traffic forwarded by using iptables.
So the steps I believe I have to take is to force the traffic from br0 get masqueraded then get forwarded to tun0 by using these commands:
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
I added also state tracking, but it didn't work:
iptables -A INPUT -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
To add a secondary default route I added in the file " /etc/iproute2/rt_tables" a "1 vpnout" entry, and added the default route:
ip route add default dev vpn-out table vpnout
which didn't work, and the same result with the next commands
ip route add default via dev vpn-out table vpnout ip rule add from 10.0.0.0/24 table vpnout ip rule add to 10.0.0.0/24 table vpnout
But still after that the I still cannot ping 184.108.40.206 from the Client connected to br0. Is there something that I'm missing out?