Routing outgoing packets to the eth0 interface based on source port

Question

I'm using an OpenVPN client on my server so all the outgoing traffic is routed through the tun0 interface created by the VPN.

I still want to run public-accessible services like SSH (on port 22) and an UDP server (on port 19132) but the VPN modifies the routing so for example outgoing SSH packets are being routed via the VPN tun0 interface making it impossible to connect from the server public ip

So, I need to route outgoing packets based on their source port, and I found different solutions online like this one.

Using the solution above, it correctly routes outgoing SSH packets so SSH works but the UDP server outgoing packets are still wrongly routed

Without VPN

# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 50:e5:49:ca:ad:12 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.5/24 brd 192.168.1.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::6052:495b:8ae4:8ade/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

# ip route

default via 192.168.1.1 dev eth0 proto static metric 100 
169.254.0.0/16 dev eth0 scope link metric 1000 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.5 metric 100

With VPN

# ip addr

1: lo: The same as without VPN
2: eth0: The same as without VPN
5: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 10.8.1.28/24 brd 10.8.1.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::2e19:d676:6826:d47d/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

# ip route

0.0.0.0/1 via 10.8.1.1 dev tun0 
default via 192.168.1.1 dev eth0 proto static metric 100 
10.8.1.0/24 dev tun0 proto kernel scope link src 10.8.1.28 
VpnPublicIp via 192.168.1.1 dev eth0 
128.0.0.0/1 via 10.8.1.1 dev tun0 
169.254.0.0/16 dev eth0 scope link metric 1000 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.5 metric 100

Attempted solution:

iptables -t mangle -A OUTPUT -p udp --sport 19132 -j MARK --set-mark 65
iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65
ip route add default via 192.168.1.1 dev eth0 table 128
ip rule add fwmark 65 table 128
ip route flush cache

Attempted solution results:

SSH outgoing packets are routed correctly over eth0 so SSH works. The UDP server outgoing packets are still routed via tun0 as shown by wireshark:

My only guess is that fwmark doesn't work for UDP probably? Since I'm using the exact same command for SSH

Answer 1

UDP packets from port 19132 were actually routed through eth0 but somehow with the wrong source address. The server was binding to 0.0.0.0 and binding to 192.168.1.5 fixed the problem.