I am looking to have a VPN enabled on ALL ports except incoming port 80 for my Apache server. My computer is connected to openvpn on Ubuntu to a router that is not connected to a vpn. It is a per device vpn connection.
First I checked for to disable reverse path filtering. I checked all the rp_filter with this
sysctl -a | grep \\.rp_filter
and disabled them:
sudo sysctl -w net.ipv4.conf.eth0.rp_filter=0
sudo sysctl -w net.ipv4.conf.tun0.rp_filter=0
etc..
I looked at the main ip route table when VPN is Disconnected:
ip route
It return me this:
default via 192.168.2.1 dev eth0 proto static
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.20 metric 1
So for testing purposes I used the outgoing port 80 and 443 in combination with a whatismyip.com or something like this.
sudo iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 2
sudo iptables -t mangle -A PREROUTING -p tcp --dport 443 -j MARK --set-mark 2
sudo ip rule add fwmark 2 table 2
ip route flush cache
And then a created a table with the exact same connection that it looks like when the VPN was disconnected
sudo ip route add 192.168.2.0/24 table 2 dev eth0 proto kernel scope link src 192.168.2.20 metric 1
sudo ip route add default table 2 via 192.168.2.1 dev eth0 proto static
And no result so far :(. I am using an Ecrypted VPN over SSL. It never bybass the VPN.
Could someone help me on this. It looks like my port filtering is not working at all and is not going into my lookup table 2. If my table 2 is empty everything still work on port 80.
Is there a better to debug the PREROUTING packets and check if they are really marked?
EDIT: After more research looks like CONFIG_IP_ROUTE_FWMARK config in the kernel is not available on Ubuntu which is required :(...