Home / server / Questions / 551392
In Process
mr.simonski
Asked: 2013-11-08 07:37:03 +0800 CST

iptables to block VPN-traffic if not through tun0

  • 772

I have a dedicated Webserver running Debian 6 and some Apache, Tomcat, Asterisk and Mail-stuff. Now we needed to add VPN support for a special program. We installed OpenVPN and registered with a VPN provider. The connection works well and we have a virtual tun0 interface for tunneling.

To archive the goal for only tunneling a single program through VPN, we start the program with

sudo -u username -g groupname command

and added a iptables rule to mark all traffic coming from groupname

iptables -t mangle -A OUTPUT -m owner --gid-owner groupname -j MARK --set-mark 42

Afterwards we tell iptables to to some SNAT and tell ip route to use special routing table for marked traffic packets.

Problem: if the VPN failes, there is a chance that the special to-be-tunneled program communicates over the normal eth0 interface.

Desired solution: All marked traffic should not be allowed to go directly through eth0, it has to go through tun0 first.

I tried the following commands which didn't work:

iptables -A OUTPUT -m owner --gid-owner groupname ! -o tun0 -j REJECT

iptables -A OUTPUT -m owner --gid-owner groupname -o eth0 -j REJECT

It might be the problem, that the above iptable-rules didn't work due to the fact, that the packets are first marked, then put into tun0 and then transmitted by eth0 while they are still marked.. I don't know how to de-mark them after in tun0 or to tell iptables, that all marked packet may pass eth0, if they where in tun0 before or if they going to the gateway of my VPN provider.

Does someone has any idea to a solution?

Some config infos:

iptables -nL -v --line-numbers -t mangle

Chain OUTPUT (policy ACCEPT 11M packets, 9798M bytes) 
num   pkts  bytes target     prot opt in     out     source       destination 
1     591K   50M   MARK       all  --  *      *       0.0.0.0/0    0.0.0.0/0   owner GID match 1005 MARK set 0x2a 
2    82812 6938K CONNMARK   all  --  *      *         0.0.0.0/0    0.0.0.0/0   owner GID match 1005 CONNMARK save

iptables -nL -v --line-numbers -t nat

Chain POSTROUTING (policy ACCEPT 393 packets, 23908 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1       15  1052 SNAT       all  --  *      tun0    0.0.0.0/0            0.0.0.0/0           mark match 0x2a to:VPN_IP

ip rule add from all fwmark 42 lookup 42

ip route show table 42

default via VPN_IP dev tun0

linux

1 Answers

  1. Just add default low priority route for marked packets

    ip rule add fwmark 42 table no.out
ip route add blackhole 0.0.0.0 metric 100 table no.out

    and than, establishing new vpn connection should setup route for the same Mark, but using lower metric.

    • 0