0

I had a server, that I needed to connect to VPN. But the moment I ran openvpn it became inaccessible. And this solution didn't help.

To investigate, I added the following rules to iptables:

iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "iptables: "
iptables -A OUTPUT -p tcp --sport 443 -j LOG --log-prefix "iptables: "

In tmux in one console I ran:

echo ------------------------ | tee /dev/tty | systemd-cat; sleep 60; pkill openvpn

In the other I started openvpn, and made a couple of https requests to the server from my local computer. After openvpn was killed I saw no entries in systemd log.

Then I ran this:

iptables -t mangle -A PREROUTING -i ens160 -m conntrack --ctstate NEW -j CONNMARK --set-mark 1234
iptables -t mangle -A OUTPUT -m connmark --mark 1234 -j MARK --set-mark 4321
ip route add default dev ens160 via def.gw table 3412
ip rule add fwmark 4321 table 3412

There were no entries in systemd journal, and the server remained inaccessible.

This worked for me. But what's wrong with the first solution?

The issue is coming from VPN server pushing these commands:

ip route add 0.0.0.0/1 via vpn.gw
ip route add 128.0.0.0/1 via vpn.gw

UPD It seems that packets coming from my local machine reach the server, but disappear when server makes a routing decision.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.