Re: Wrong routing when combining ip rule with SNAT

[Nikolaus Rath <Nikolaus@rath.org>]

Pascal Hambourg <pascal@plouf.fr.eu.org> writes:
> Alex Bligh a écrit :
>> 
>> I don't think you need iptables. The way I've always done it is:
>> * Default route to the VPN device
>> * /32 route for the VPN endpoint out the physical interface to
>>   the previous default route
>
> This does not meet the following OP's requirement :
>
>>> The hard part is to also tunnel non-VPN connections to the VPN node
>>> itself. In other words how do I make sure that every connection to the
>>> external ip of the VPN node is tunneled through its internal ip --
>>> except for the packets that form the tunnel itself?
>
> However I am not sure this is a sensible requirement.

Why not? For example, the VPN node also acts as my mailserver. So
whenever I encounter firewalls that e.g. block everything but port 443
and 80, I have to establish a tunnel to be able to connect to port 25,
and then change the mail server name in my MUA to the internal name on
the VPN. Then, if I'm at a different location where I do not need the
VPN, I have to change it back to the public hostname.

That is rather annoying, and I could avoid it if I somehow get
the smtp connections to use the VPN gateway as well.

Admittedly, I could just run the VPN all the time, but I don't think
this makes the whole idea unsensible.

>>> My idea was install a default route to the internal ip of the VPN node,
>>> use iptables to mark the VPN connections and then set up a special
>>> routing table for those.
>
> Sounds good. Make sure that packets related to the VPN connection (e.g.
> ICMP error messages) are routed outside the tunnel too. I guess that can
> be done with connmark (connection mark).

Well, that was the idea that led to my original question. It doesn't
work, because the packets go out with the wrong source ip
address. Apparently, at the time that the source ip address is
determined, the connection hasn't been marked yet, so it takes the
source ip from the wrong routing table.


Best,

   -Nikolaus

-- 
 »Time flies like an arrow, fruit flies like a Banana.«

  PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6  02CF A9AD B7F8 AE4E 425C