I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly

[localhost] -> [gateway] -> [remote] - OK

[localhost] <- [gateway] <- [remote] - packet dissappears after vpn tunnel. I am able to sniff that on tun0 iface, then it dissappears.

What I did: added gw1 to rt_tables then used this rules

ip route add default via dev tun0 table gw1
ip rule add fwmark 0x1 table gw1
iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1
iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to
iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1
iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to

So I am testing tcp and udp connections and what I see:

  • On remote side everything works correctly and packet is send back to gateway to eth0
  • On gateway packet gets passed back to vpn tunnel (tun0)
  • On localhost that sent that packet I see how packet arrive to (tun0) in tshark and then it dissapears. And localhost does TCP-retransmission or resends UDP packet.

I checked packet capture in wireshark and all ports are correct so it's using same random dynamic port during all that trasfer: back and forward. I also tried using masquerade on localhost instead of SNAT without any success. Tried redirecting packets with DNAT to with no success but I am not sure, maybe I'm doing anything wrong.

Why that packet dissapears after tun0? My input chain allows everything for now. Maybe I need to enable or disable any new "features" in sysctl.conf that I am not concerned about?



My rules are correct


for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done
echo 1 > /proc/sys/net/ipv4/route/flush 

Now everything is working fine. Note that you need to disable that on every iface, option "all" are not working fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.