0

I have two interfaces: eth0 and tun5. eth0 is an ethernet to a router and tun5 is a VPN tunnel. These are on an UnRaid server, which is based on Linux. It's a headless server so I access it via SSH.

I'm wanting to have all traffic go through the VPN, tun5, except for ports X, Y, and Z, which I want to come and go through the ethernet.

ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.11  netmask 255.255.255.0  broadcast 192.168.1.255
        ether 00:19:66:e6:bb:52  txqueuelen 1000  (Ethernet)
        RX packets 21687  bytes 7281101 (6.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 64398  bytes 5734722 (5.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 0  (Local Loopback)
        RX packets 3496  bytes 942735 (920.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3496  bytes 942735 (920.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun5: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.119.1.6  netmask 255.255.255.255  destination 10.119.1.5
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 9  bytes 764 (764.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    1      0        0 eth0
10.119.1.5      0.0.0.0         255.255.255.255 UH    0      0        0 tun5
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0


iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


ip rule
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default


ip route
default via 192.168.1.1 dev eth0  metric 1
10.119.1.5 dev tun5  proto kernel  scope link  src 10.119.1.6
127.0.0.0/8 dev lo  scope link
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.11

The router gives it an IP of 192.168.1.11 and that's what I use to SSH in.

Can anyone help me figure out some routing for this? I've tried following: http://lartc.org/howto/lartc.rpdb.multiple-links.html and http://www.linuxhorizon.ro/iproute2.html but I get locked out of SSH near the end and can't proceed. Would I be on the right track if I can access the console directly?

1 Answer 1

0

Routing happens on IP level, ports start at the TCP level. So you can't use routes to switch for ports.

If you want to use iptables you might try this approach: iptables forward specific port to specific nic (StackOverflow)

Mark packages which should go via eth1:

iptables -A PREROUTING -i eth0 -t mangle -p tcp --dports 22,53,80,443 -j MARK --set-mark 1

Add rule eth1.out to route marked packages:

echo "201 eth1.out" >> /etc/iproute2/rt_tables
ip rule add fwmark 1 table eth1.out

Route all marked packages via eth1:

/sbin/ip route add default via 192.168.2.1 dev eth1 table eth1.out

Route everything else via eth2:

/sbin/ip route add default via 192.168.3.1 dev eth2

If MARK rule won't work, try using CONNMARK.

You can also tell ssh to use a specific address to connecto to the server. You can either do this with

ssh <user>@<host> -b <IP to bind>

or you can set it more permanently in your ~/.ssh/config like this

Host        <alias name>
HostName    <remote hostname>
BindAddress <IP to bind>

whereby <IP to bind> would be 192.168.1.11 in this case.

4
  • I believe I want the reverse of the first snippet. Force port 9987 to use eth0, even if it wanted to use tun5. Would reversing the names and changing the port achieve this? I'm about to try it on the server anyway Aug 7, 2014 at 22:36
  • I changed it a bit Aug 7, 2014 at 22:44
  • I tried it, but I get iptables v1.4.20: Can't use -o with PREROUTING. It looks like exactly like what I want though. Aug 7, 2014 at 22:47
  • I changed my answer again Aug 7, 2014 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .