I had a server, that I needed to connect to VPN. But the moment I ran
openvpn it became inaccessible. And this solution didn't help.
To investigate, I added the following rules to iptables:
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "iptables: " iptables -A OUTPUT -p tcp --sport 443 -j LOG --log-prefix "iptables: "
tmux in one console I ran:
echo ------------------------ | tee /dev/tty | systemd-cat; sleep 60; pkill openvpn
In the other I started
openvpn, and made a couple of https requests to the server from my local computer. After
openvpn was killed I saw no entries in systemd log.
Then I ran this:
iptables -t mangle -A PREROUTING -i ens160 -m conntrack --ctstate NEW -j CONNMARK --set-mark 1234 iptables -t mangle -A OUTPUT -m connmark --mark 1234 -j MARK --set-mark 4321 ip route add default dev ens160 via def.gw table 3412 ip rule add fwmark 4321 table 3412
There were no entries in systemd journal, and the server remained inaccessible.
This worked for me. But what's wrong with the first solution?
The issue is coming from VPN server pushing these commands:
ip route add 0.0.0.0/1 via vpn.gw ip route add 220.127.116.11/1 via vpn.gw
UPD It seems that packets coming from my local machine reach the server, but disappear when server makes a routing decision.