Pascal Hambourg <pascal@xxxxxxxxxxxxxxx> writes: > Alex Bligh a écrit : >> >> I don't think you need iptables. The way I've always done it is: >> * Default route to the VPN device >> * /32 route for the VPN endpoint out the physical interface to >> the previous default route > > This does not meet the following OP's requirement : > >>> The hard part is to also tunnel non-VPN connections to the VPN node >>> itself. In other words how do I make sure that every connection to the >>> external ip of the VPN node is tunneled through its internal ip -- >>> except for the packets that form the tunnel itself? > > However I am not sure this is a sensible requirement. Why not? For example, the VPN node also acts as my mailserver. So whenever I encounter firewalls that e.g. block everything but port 443 and 80, I have to establish a tunnel to be able to connect to port 25, and then change the mail server name in my MUA to the internal name on the VPN. Then, if I'm at a different location where I do not need the VPN, I have to change it back to the public hostname. That is rather annoying, and I could avoid it if I somehow get the smtp connections to use the VPN gateway as well. Admittedly, I could just run the VPN all the time, but I don't think this makes the whole idea unsensible. >>> My idea was install a default route to the internal ip of the VPN node, >>> use iptables to mark the VPN connections and then set up a special >>> routing table for those. > > Sounds good. Make sure that packets related to the VPN connection (e.g. > ICMP error messages) are routed outside the tunnel too. I guess that can > be done with connmark (connection mark). Well, that was the idea that led to my original question. It doesn't work, because the packets go out with the wrong source ip address. Apparently, at the time that the source ip address is determined, the connection hasn't been marked yet, so it takes the source ip from the wrong routing table. Best, -Nikolaus -- »Time flies like an arrow, fruit flies like a Banana.« PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6 02CF A9AD B7F8 AE4E 425C -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
