I have changed my setup accordingly now, however there are still packets showing up on the default qdisc when I go through the tunnel, about half the packets don't seem to match.
If there really only is udp traffic on port 5001, I don't see why your rules should match that only partially. If they were wrong, they'd either match everything or nothing at all, wouldn't they?
Did you see anything wrong with the filter rules. Openvpn uses port 5001 on both ends, and tcpdump -i eth0 shows udp packets going back and forth on port 5001 and no other traffic, yet the default counter goes up along with the 1:10 qdisc.
I don't know tcpdump - when debugging filter rules, I usually adapt these rules to iptables and use iptables log with different prefixes to distinct which packets matched which rules (and which didn't match at all). If nothing shows up this way, then I too am clueless as to what might be wrong. Maybe someone else has a suggestion. :)
I don't have any experience with OpenVPN myself, so I don't know what's the best way to match OpenVPN traffic. Using port criteria alone, might not be waterproof enough, as long as anyone can use these ports for anything. Matching both IP and Port would probably be more reliable.
Andreas _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
