Hello,
I want to setup bandwidth restrictions for a few clients that use openvpn to connect to my server. I'm using iptables to mark the packets in the mangle table (PRE/POSTROUTING) on eth0 before they get sent via the tunnel. Will the mark survive even if the packets then get routed via an openvpn tunnel (tunX) out the box or does openvpn change it removing the mark ?
openVPN is just a userspace process that - depending on configuration - doesn't even need root access to run. (provided the device nodes are set up accordingly).
Depending on what you do, the mark should survive (never tested this), or not.
If you are just forwarding to a tun/tap, the mark should survive like usual. There is no difference between a tun/tap device and another ethernet device with regard to this point.
However, once a packet reaches the tun/tap, it gets transfered to openVPN which encrypts it and sends it out using udp (or tcp, depending on configuration) of a real interface. These outgoing packets are not having the mark on them, primarily because they are completely different packets that were generated by openVPN and not really directly related to what went into the tun/tap device. I suspect that is however what you'd like to achieve. Note that openVPN does has its own shaping directive (--shaper n) which may help you in this case.
--
C U
- -- ---- ----- -----/\/ René Gallati \/\---- ----- --- -- - _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
