Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to forward all packet coming from internet to tun0. Quick scheme:

internet <-> eth0 ( <-> tun0 ( <-> local program.

Currently I am using ROUTE target for acheiving this.>

iptables -A PREROUTING -t mangle -p tcp -s -j ROUTE --oif eth0

iptables -A PREROUTING -t mangle -p tcp -d -j ROUTE --oif tun0

then I learned the ROUTE target support is been removed from kernel 2.6.32 ( iptables 1.4.8 )

After some quick search it turned out this is also possible with mark, but not sure how to do.

iptables -t mangle -A PREROUTING -i eth0 xxx -j MARK --set-mark 1

ip rule add fwmark 1 table (nb?)

Btw I'm running Debian squeeze with security updates.

Johnnie Alan

share|improve this question

migrated from Nov 18 '11 at 4:15

This question came from our site for professional and enthusiast programmers.

Using the same network address on two interfaces is asking for trouble. I'd renumber the tun0 network, then set up NAT to deal with the fallout. With tun0 set up between (local) and (remote):

iptables -t nat -I PREROUTING -d -j DNAT --to-dest

This still requires that packets for arrive at this host, so all hosts (or at least those that need to contact the box on the other side) on this network need

ip r a via

Alternatively, you can use proxy ARP, but that is generally messy.

In addition, the box on the other side needs to have its default route point to the tunnel so returning packets go the same way; you can also add a SNAT rule in POSTROUTING to make all connections appear to the other box as from the other tunnel endpoint:

iptables -t nat -I POSTROUTING -d -j SNAT --to-source
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.