In my modified OpenVPN server process, as an intermediate node, I'd need to embed my custom 3 bytes data in the header of every IP packet and then in the same machine (after going through tun) filter those packets by those custom 3 bytes.

Where's the best place in IPv4 header to put my 3 bytes? And how to retrieve it using iptables? Please note that I won't need those 3 bytes anymore after being processed by iptables.

  • Every IP packet? What's the point of changing the packet, then, if you match all? You can use the iptables mark option (if you don't have to change the packet itself), for example. Or try out libnetfilter_queue – Lenniey Aug 14 '19 at 11:47
  • @Lenniey I rephrased the question. In server side OpenVPN process I need to tag every IP packets with 3 bytes data and using iptables retrieve the tag and do an appropriate action based on this tag. – frogatto Aug 14 '19 at 12:07
  • I still don't get why you can't just filter for source-interface tun, if you embed the bytes in every OpenVPN packet. Maybe this is an XY problem? To filter for specific "bytes" you could use the u32 module, maybe? – Lenniey Aug 14 '19 at 12:16
  • @Lenniey Those "bytes" are not same for all packets, so I need to drop the packets tagged with some of them, something like a switch case statement. – frogatto Aug 14 '19 at 12:23
  • @Lenniey Thanks for the u32 module, definitely it helps. But where in the IP packet should I put those 3 bytes? – frogatto Aug 14 '19 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.