Linux port-based routing using iptables/ip route

Question

I have the following setup:

192.168.0.4        192.168.0.6      192.168.0.1
+-----------+      +---------+      +----------+
|WORKSTATION|------|  LINUX  |------| GATEWAY  |
+-----------+      +---------+      +----------+
                   192.168.150.10
                        |
                   192.168.150.9
                   +---------+
                   |   VPN   |
                   +---------+
                   192.168.150.1

WORKSTATION has a default route of 192.168.0.6 LINUX has a default route of 192.168.0.1

I am trying to use the gateway as the default route, but route port 80 traffic via the VPN. Based on what I read at http://www.linuxhorizon.ro/iproute2.html I have tried this:

echo "1 VPN" >> /etc/iproute2/rt_tables
sysctl net.ipv4.conf.eth0.rp_filter = 0
sysctl net.ipv4.conf.tun0.rp_filter = 0
sysctl net.ipv4.conf.all.rp_filter = 0

iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j MARK --set-mark 0x1
ip route add default via 192.168.150.9 dev tun0 table VPN
ip rule add from all fwmark 0x1 table VPN

When I run "tcpdump -i eth0 port 80" on LINUX, and open a webpage on WORKSTATION, I don't see the traffic go through LINUX at all. When I run a ping from WORKSTATION, I get this back from some packets:

92 bytes from 192.168.0.6: Redirect Host(New addr: 192.168.0.1)
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 de91   0 0000  3f  01 4ed3 192.168.0.4  139.134.2.18

Is this why my routing is not working ? Do I need to put GATEWAY and LINUX on different subnets to prevent WORKSTATION being redirected to GATEWAY ? Do I need to use NAT at all, or can I do this with routing alone (which is what I want) ?

Answer 1

"LINUX" is telling "WORKSTATION" to use "GATEWAY" instead of itself because they appear to be on the same subnet. This can only work if you've set up bridging on "LINUX" (see brctl(8)), and if you did then "WORKSTATION" should use "GATEWAY" in its default route.

Make sure you use a subnet per broadcast domain, broadcast packets are never routed so you need a different subnet on all 3 interfaces of "LINUX" (you could use /30s but I recommend sticking to /24s for growth). or have it bridge them. You should probably also configure a separate subnet for the VPN itself.

Next, add the VPN subnet to the VPN table, e.g.:

ip route add 192.168.150.0/24 dev tun0 scope link table VPN proto static

In order to use this table, add a routing rule like so:

ip rule add fwmark 1 lookup VPN priority 500

And see if you can route packets via both "VPN" and "GATEWAY" before you add any fwmark rules, just in case.

And I don't think disabling the reverse path filter is beneficial.

Answer 2

I see this question is pretty old, but thought I would add a quick note in case it helps someone with the same problem. While it is probably best to separate the devices in to different network segments as Henk recommends, if that is not possible there is a workaround.

The Redirect that is happening where Linux (192.168.0.6) tells the workstation (192.168.0.4) to use the gateway (192.168.0.1) can be disabled by making the following change to your /etc/sysctl.conf file on the Linux server:

net.ipv4.conf.all.send_redirects = 1