I am kind of new to the whole networking thing on linux. I am running Ubuntu 20.04, linux 5.4.0-25-generic. I am trying to do the following and I am a little stuck.
I have a interface: bond0
, that is my local interface between my server and the internet. I also have a OpenVPN client, tun1
, that is used to encrypt all my traffic out of my server.
I am trying to route port X and port Y out of bond0
instead of the tun1
which is the default.
What I have tried already:
I saw this thread here, but for some reason it did not seem to work. I made the ip route table 80, and did all the things the guide said to do, but I can't get the traffic to come out of the bond instead of the tun.
I can tell it is not working because I am still unable to access those ports through the external IP address.
Here is some more information:
bond0
: 192.168.50.34- Router: 192.168.50.1
tun1
: 10.44.10.6
Possibly related, but I am also running an OpenVPN server through tun0
, so I have set up some forwarding through that, but I do not think it is related.
If someone could give me another thing to try to get this port routing to work, that would be great!
UPDATE
iptables -t mangle -nvL
Chain PREROUTING (policy ACCEPT 14576 packets, 2179K bytes)
pkts bytes target prot opt in out source destination
14668 2198K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore
Chain INPUT (policy ACCEPT 14576 packets, 2179K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 14840 packets, 8224K bytes)
pkts bytes target prot opt in out source destination
14874 8228K markports all -- * * 0.0.0.0/0 0.0.0.0/0 mark match 0x0
14863 8227K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK save
Chain POSTROUTING (policy ACCEPT 14883 packets, 8227K bytes)
pkts bytes target prot opt in out source destination
Chain markports (1 references)
pkts bytes target prot opt in out source destination
104K 19M MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:32400 MARK set 0x80
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1195 MARK set 0x80
5 469 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 MARK set 0x80
90 11706 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 MARK set 0x80
ip route show table 80
default via 192.168.50.1 dev bond0
192.168.50.0/24 dev bond0 scope link src 192.168.50.34
ip rule
0: from all lookup local
32765: from all fwmark 0x80 lookup 80
32766: from all lookup main
32767: from all lookup default
SECOND UPDATE
In the hyperlinked text above, I ended up getting the packets to forward to the local interface. Before I was not able to stream anything from the server to a client, but I think there was an error in one of the commands:
iptables -t mangle -I OUTPUT 1 -m mark --mark 0 -j markports
When I changed the command to this:
iptables -t mangle -I OUTPUT 1 -m mark --mark 0x80 -j markports
I was able to stream packets to the server. Still not able to access the server over the internet, but now this could be a different issue. Will be investigating tcpdump over the next couple of days.
tcpdump
for checking what is happening on an interface. What is the output ofiptables -t mangle -nvL
,ip route show table 80
,ip rule
? Do not answer that in a comment; add the information to the question.markports
is called fromOUTPUT
only and matches destination ports only. For incoming connections you have to match source ports there.