Route all traffic (except port 3336 and a few more) from eth0 to specific ip

Question

How can I route all incoming traffic from eth0 interface to ip 10.8.0.5 (VPN tunnel)?

I need to forward incoming traffic except port 3666, to specific ip on ubuntu 22.04 machine.

In future list of ports that should not be routed will get bigger.

How can i do it the best way?

I have explained my situation here -> Proxy all requests from one machine to another using nginx or anything else

Answer 1

If I understand your description and your other (proxy-post) correctly, you will want to do a DNAT (Destination Network Address Translation ... also called port-forwarding) on all ports apart from 3666/tcp, so inbound traffic on interface eth0 (with destination address of the server itself) is port-forwarded to 10.8.0.5. That's easily accomplished in the iptables nat table:

if you want this to happen before any other potentially exiting PREROUTING rules, as root:

iptables --table nat --insert PREROUTING --in-interface eth0 --jump DNAT --to-destination 10.8.0.5
iptables --table nat --insert PREROUTING --in-interface eth0 --protocol tcp --destination-port 3666 --jump ACCEPT

or if you want it after potentially existing PREROUTING rules, as root:

iptables --table nat --append PREROUTING --in-interface eth0 --protocol tcp --destination-port 3666 --jump ACCEPT
iptables --table nat --append PREROUTING --in-interface eth0 --jump DNAT --to-destination 10.8.0.5

(note --append instead of --insert and the reversed order)

Answer 2

As @frax already said, I had to use DNAT to route traffic in my case.

Hours of searching, googling, communicating with ChatGPT brought me needed result.

Firstly, i decided to use iptables console utility as the most powerful tool for setting up firewall and NATs.

To add port 3666 to 'exclusion list', firewall must accept incoming traffic from this port:

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3666 -j ACCEPT

NOTE: my networking interface is eth0, it can be different in other cases. To check it out run following command:

ip a

Now, to add rule for forwarding all remaining traffic to specific ip, we can run following in command line:

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp -j DNAT --to-destination 10.8.0.5

NOTE: my destination IP (10.8.0.5) belongs to VPN connection, established earlier. Change it to any IP address you need