I am looking to have a VPN enabled on ALL ports except incoming port 80 for my Apache server. My computer is connected to openvpn on Ubuntu to a router that is not connected to a vpn. It is a per device vpn connection.

First I checked for to disable reverse path filtering. I checked all the rp_filter with this

sysctl -a | grep \\.rp_filter

and disabled them:

sudo sysctl -w net.ipv4.conf.eth0.rp_filter=0
sudo sysctl -w net.ipv4.conf.tun0.rp_filter=0

I looked at the main ip route table when VPN is Disconnected:

ip route

It return me this:

default via dev eth0  proto static dev eth0  proto kernel  scope link src  metric 1

So for testing purposes I used the outgoing port 80 and 443 in combination with a whatismyip.com or something like this.

sudo iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 2
sudo iptables -t mangle -A PREROUTING -p tcp --dport 443 -j MARK --set-mark 2
sudo ip rule add fwmark 2 table 2
ip route flush cache

And then a created a table with the exact same connection that it looks like when the VPN was disconnected

sudo ip route add table 2 dev eth0  proto kernel  scope link  src  metric 1
sudo ip route add default table 2 via dev eth0 proto static

And no result so far :(. I am using an Ecrypted VPN over SSL. It never bybass the VPN.

Could someone help me on this. It looks like my port filtering is not working at all and is not going into my lookup table 2. If my table 2 is empty everything still work on port 80.

Is there a better to debug the PREROUTING packets and check if they are really marked?

EDIT: After more research looks like CONFIG_IP_ROUTE_FWMARK config in the kernel is not available on Ubuntu which is required :(...


I finally found it! It was hidden in the kernel parameters.

Mark packets was just not working, but with a new Kernel option in the kernel 3.16+ make it works: sysctl -w net.ipv4.tcp_fwmark_accept=1



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.