On Mon, Aug 3, 2020 at 12:08 AM Jeffrey Ross <jeff(a)bubble.org> wrote:
Now the only issue is I need to force all traffic originated by me
(eg
when I'm the client) out eth0 and only use vpn0 when traffic
specifically hits that interface.
This is called policy routing and is pretty straightforward. All of
the solutions listed here so far are more complicated than is needed.
I'm afraid I've never used firewalld, so I can't help with that. But
using native iproute commands, the steps are as follows:
1. Firstly, create a new routing table. These are numbered by default,
but we can associate a name (let's use "vpn") with the number
(arbitrarily I've picked 77, to match the last octet of my router) to
make it easier to use:
echo 77 vpn >> /etc/iproute2/rt_tables
2. Next create a default route in the new routing table, sending
traffic via your VPN:
ip route add default dev vpn0 via 192.168.8.77 table vpn
3. Now we can add a rule to tell traffic to use that routing table if
certain criteria are met:
ip rule add dport 1234 iif eth0 lookup vpn
This says that if a packet has a destination port of 1234 and the
incoming device is eth0, then route it using the vpn table (which
we've already configured to send traffic via the vpn0 device). It's
trivial to add another table and another rule to handle the second
interface you mentioned. You can check the status of your new routing
table, and the relevant ip rules with:
ip route show table vpn
ip rule show
The ip-rule(8) man page goes into more depth about the available
criteria for when to trigger a rule.
Tet
--
I saw cout being shifted "Hello world" times to the left and stopped
right there. — Steve Gonedes