I am kind of new to the whole networking thing on linux. I am running Ubuntu 20.04, linux 5.4.0-25-generic. I am trying to do the following and I am a little stuck.
I have a interface:
bond0, that is my local interface between my server and the internet. I also have a OpenVPN client,
tun1, that is used to encrypt all my traffic out of my server.
I am trying to route port X and port Y out of
bond0 instead of the
tun1 which is the default.
What I have tried already:
I saw this thread here, but for some reason it did not seem to work. I made the ip route table 80, and did all the things the guide said to do, but I can't get the traffic to come out of the bond instead of the tun.
I can tell it is not working because I am still unable to access those ports through the external IP address.
Here is some more information:
- Router: 192.168.50.1
Possibly related, but I am also running an OpenVPN server through
tun0, so I have set up some forwarding through that, but I do not think it is related.
If someone could give me another thing to try to get this port routing to work, that would be great!
iptables -t mangle -nvL
Chain PREROUTING (policy ACCEPT 14576 packets, 2179K bytes) pkts bytes target prot opt in out source destination 14668 2198K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore Chain INPUT (policy ACCEPT 14576 packets, 2179K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 14840 packets, 8224K bytes) pkts bytes target prot opt in out source destination 14874 8228K markports all -- * * 0.0.0.0/0 0.0.0.0/0 mark match 0x0 14863 8227K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK save Chain POSTROUTING (policy ACCEPT 14883 packets, 8227K bytes) pkts bytes target prot opt in out source destination Chain markports (1 references) pkts bytes target prot opt in out source destination 104K 19M MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:32400 MARK set 0x80 0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1195 MARK set 0x80 5 469 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 MARK set 0x80 90 11706 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 MARK set 0x80
ip route show table 80
default via 192.168.50.1 dev bond0 192.168.50.0/24 dev bond0 scope link src 192.168.50.34
0: from all lookup local 32765: from all fwmark 0x80 lookup 80 32766: from all lookup main 32767: from all lookup default
In the hyperlinked text above, I ended up getting the packets to forward to the local interface. Before I was not able to stream anything from the server to a client, but I think there was an error in one of the commands:
iptables -t mangle -I OUTPUT 1 -m mark --mark 0 -j markports
When I changed the command to this:
iptables -t mangle -I OUTPUT 1 -m mark --mark 0x80 -j markports
I was able to stream packets to the server. Still not able to access the server over the internet, but now this could be a different issue. Will be investigating tcpdump over the next couple of days.