[LARTC] iptables mark + openvpn will the mark survive ?

[LARTC] iptables mark + openvpn will the mark survive ?

[Etienne Ledoux]

Greetings,

I want to setup bandwidth restrictions for a few clients that use openvpn to 
connect to my server. I'm using iptables to mark the packets in the mangle 
table (PRE/POSTROUTING) on eth0 before they get sent via the tunnel. Will the 
mark survive even if the packets then get routed via an openvpn tunnel (tunX) 
out the box or does openvpn change it removing the mark ?

damnit, just as I think I'm starting to understand this stuff, I get confused 
all over.

tx.

e.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] iptables mark + openvpn will the mark survive ?

[Rene Gallati]

Hello,

> I want to setup bandwidth restrictions for a few clients that use openvpn to 
> connect to my server. I'm using iptables to mark the packets in the mangle 
> table (PRE/POSTROUTING) on eth0 before they get sent via the tunnel. Will the 
> mark survive even if the packets then get routed via an openvpn tunnel (tunX) 
> out the box or does openvpn change it removing the mark ?

openVPN is just a userspace process that - depending on configuration - 
doesn't even need root access to run. (provided the device nodes are set 
up accordingly).

Depending on what you do, the mark should survive (never tested this), 
or not.

If you are just forwarding to a tun/tap, the mark should survive like 
usual. There is no difference between a tun/tap device and another 
ethernet device with regard to this point.

However, once a packet reaches the tun/tap, it gets transfered to 
openVPN which encrypts it and sends it out using udp (or tcp, depending 
on configuration) of a real interface. These outgoing packets are not 
having the mark on them, primarily because they are completely different 
packets that were generated by openVPN and not really directly related 
to what went into the tun/tap device. I suspect that is however what 
you'd like to achieve. Note that openVPN does has its own shaping 
directive (--shaper n) which may help you in this case.


-- 

C U

      - -- ---- ----- -----/\/  René Gallati  \/\---- ----- --- -- -
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/