LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 09-20-2010, 12:35 PM   #1
malo_umoran
Member
 
Registered: Dec 2003
Distribution: Desktop: Slackware 13.1 &13.37 | Server: Debian 6.0
Posts: 270

Rep: Reputation: 32
iptables: preroute outgoing packets from tun0 to eth0 ?


I have a strange problem.

I have ssh daemon running on my server (192.168.1.2, eth0).
Default gateway all traffic is 192.168.1.1 (my router).
Router has a public ip 123.123.123.123 and port 22222 is forwarding everything to my server (192.168.1.2) on port 22.

That is nothing special.
I just set port when I want to connect to my server from outside:
Code:
ssh -p22222 user@123.123.123.12

When I connect to a VPN server I get on tun0 device IP 10.0.2.3 (tun0). Default gateway is being changed to 10.0.2.1 and only connections to 192.168.1.0/24 are going through 192.168.1.1

That is absolutely OK because I want all connections to go through VPN.


This is where the problem begins:
When I now try to connect from outside (i.e. 1.2.3.4) to my server by using the above command connection is not being established. iptables log gave me the explanation:

1. incoming packets for server connection are coming through eth0

2. but outgoing packets from my server to 1.2.3.4 are going through VPN gateway (10.0.2.1, tun0) (because that is default gateway when VPN connection is active)


Any ideas how could I solve this? I could set one more route for IP 1.2.3.4 to force it to go through eth0 but 1.2.3.4 is a dynamic IP which I get on my 3G connection on my notebook.


I was thinking about prerouting/post outgoing packets on tun0 for port 22 to eth0 but I was not able to find anything for that in iptables. Is it even possible to solve it like that?


Could I maybe somehow add route on first incoming packet for this IP and delete it when the connection is gone?

Or is there some much elegant solution?

Thanks
 
Old 09-20-2010, 04:11 PM   #2
malo_umoran
Member
 
Registered: Dec 2003
Distribution: Desktop: Slackware 13.1 &13.37 | Server: Debian 6.0
Posts: 270

Original Poster
Rep: Reputation: 32
OK, I was thinking too complicated. I made a ssh tunnel to my server:

Code:
ssh -fN -p22 root@123.123.123.123 -L 22222:192.168.1.2:22
and than I connect locally:

Code:
ssh -p22222 user@localhost


That is working pretty OK but is not a solution I like:
1. I have to keep open SSH port on my router
2. I have to connect twice (router + server)



So back to my original question: Is there a way to somehow force a service or iptables rule to a specific gateway?
 
Old 09-22-2010, 02:35 AM   #3
malo_umoran
Member
 
Registered: Dec 2003
Distribution: Desktop: Slackware 13.1 &13.37 | Server: Debian 6.0
Posts: 270

Original Poster
Rep: Reputation: 32
Nobody has other ideas?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables question with OpenVPN (tun0 to tun0 filtering) fang0654 Linux - Server 3 09-30-2009 02:17 AM
Forwarding the IP frame from tun0 to eth0 johnniealan Linux - Networking 1 09-29-2009 08:10 PM
creating Iptables for tun0 device johnniealan Linux - Networking 2 05-24-2009 11:04 PM
Iptables/Guarddog - how to block specific outgoing packets craftybytes Linux - Security 7 05-19-2006 12:26 AM
drop incoming/outgoing packets using iptables doshiaj Linux - Security 1 06-08-2004 10:38 AM


All times are GMT -5. The time now is 02:21 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration