I have a gateway machine on my network running a VPN which routes outgoing traffic through a router, but the masquerading rules prevent the machines on the network from connecting directly to the router, as the masquerading rules route the outgoing traffic through the VPN .

These are the masquerading rules on the gateway machine:

iptables -t nat -A POSTROUTING -s -o tunGateway01 -j MASQUERADE
iptables -A FORWARD -s -o eth0 -j ACCEPT
iptables -A FORWARD -d -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT

The culprit iptables rules seems to be this one

iptables -t nat -A POSTROUTING -s -o tunGateway01 -j MASQUERADE

The router itself has the IP address but the masquerading rule sends out all packets from the machines through which is the subnet used by the tunGateway01 device, so I need a rule which checks if the destination is and will route it directly to the router.

Is there an iptables masquerading syntax that includes changing the route based on the packet's destination, eg something along the lines of

iptables -t nat -A POSTROUTING -s -d -o wan01 -j MASQUERADE

The -d is the destination rule that makes out the target to be the wan device and I have changed and the -o wan01 changes the target of the packet the router itself.

  • 1
    It's a misconception: the masquerading doesn't change the route: the POSTROUTING hook happens after routing, as its name implies. It's your tunnel software which chose to route through tunGateway01. The solution is mostly about routing, not iptables (but in some cases might have to involve iptables anyway). If you're still curious with this question, you should include more configuration (especially ip route and ip rule). – A.B Apr 20 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.