I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly
[localhost] -> [gateway] -> [remote] - OK
[localhost] <- [gateway] <- [remote] - packet dissappears after vpn tunnel. I am able to sniff that on tun0 iface, then it dissappears.
What I did: added gw1 to rt_tables then used this rules
ip route add default via 10.8.0.1 dev tun0 table gw1 ip rule add fwmark 0x1 table gw1 iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1 iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to 10.8.0.2 iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1 iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to 10.8.0.2
So I am testing tcp and udp connections and what I see:
- On remote side everything works correctly and packet is send back to gateway to eth0
- On gateway packet gets passed back to vpn tunnel (tun0)
- On localhost that sent that packet I see how packet arrive to 10.8.0.2 (tun0) in tshark and then it dissapears. And localhost does TCP-retransmission or resends UDP packet.
I checked packet capture in wireshark and all ports are correct so it's using same random dynamic port during all that trasfer: back and forward. I also tried using masquerade on localhost instead of SNAT without any success. Tried redirecting packets with DNAT to 127.0.0.1 with no success but I am not sure, maybe I'm doing anything wrong.
Why that packet dissapears after tun0? My input chain allows everything for now. Maybe I need to enable or disable any new "features" in sysctl.conf that I am not concerned about?