I read this answer beforehand, it says:

ip rule add from x.x.x.x table 100
ip route add table 100 to y.y.y.y/y dev ethX
ip route add table 100 default via z.z.z.z

The problem is, this will apply to all ports, and then I could use iptables to DROP certain connections, but that's not what I want.

I want the OpenVPN to...

  • Exclude some ports, like SSH, TeamViewer, etc.
  • Tunnel all other ports, not DROP them.

Client is a Mac Mini. I can change server config if needed.

  • Do you want to exclude the connections to specific ports via VPN for them to bypass the tunnel and connect directly to the endpoint (and not via VPN)? – Lenniey Jan 8 at 16:39
  • @Lenniey Yes. OR only tunnel certain ports, either way. Currently, my IP is still my public IP, but when I enable Should client Internet traffic be routed through the VPN? I can't TeamViewer (Port 5938) into it. – Austin Huang Jan 8 at 17:15

This can be achieved using iptables mangle. Your routing tables are fine, you just have to add some rules to ex/include the specific traffic.

In your case it would be something like this for SSH:

ip rule add fwmark 2 table 100
ip route flush cache
iptables -t mangle -A OUTPUT -p tcp --dport 22 -j MARK --set-mark 2
iptables -t nat -A POSTROUTING -o ethX -j SNAT --to-source z.z.z.z
                                  ^                        ^
                               your public interface      your public IP

This will:

  1. set fwmark 2 to your routing table 100
  2. flush the routing cache to avoid interference
  3. set mark 2 for all packets to destination port 22 (SSH)
  4. SNAT all packets going out of ethX to your public IP

I don't know if you need all of this or have to turn it around, depends on which way you want to look at it (all traffic via OpenVPN except xxx, or no traffic via OpenVPN except xxx).

E.g. you don't even have to use routing tables, but it certainly is much cleaner this way, or you don't need the SNAT / masquerade etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.