hey, i have a working configuration for my openvpn server (dd-wrt) and clients which works normally on my public internet address.
i am using a default route via the pptp interface for my normal internet traffic.
i successfully added routing rules for ftps, ssh, synology etc. so specific ports are still routed via public internet address and not the pptp address.
i tried to add a similar rule for openvpn, however it is still routed via the pptp interface and ip address which is obviously extremely slow.
can anyone advise on which rule to add and openvpn traffic (10.8.0.0/24) is routed via the public ip address?
thx
server config:
daemon
server 10.8.0.0 255.255.255.0
proto udp
port 21194
dev tap0
dh /opt/share/easy-rsa/keys/dh1024.pem
key /opt/share/easy-rsa/keys/i2server.key
cert /opt/share/easy-rsa/keys/i2server.crt
ca /opt/share/easy-rsa/keys/ca.crt
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
tls-server
mode server
tls-auth /opt/etc/openvpn/ta.key 0
status /opt/etc/openvpn/openvpn-status.log
log /opt/etc/openvpn/openvpn.log
client-to-client
client-config-dir /opt/etc/openvpn/ccd
client:
client
dev tap0
remote xxx.ath.cx 21194
persist-key
persist-tun
tls-client
comp-lzo
verb 3
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
float
routing table:
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.35.252 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
80.XXX.YYY.ZZZ 0.0.0.0 255.255.255.255 UH 0 0 0 vlan2
216.196.109.144 80.XXX.YYY.1 255.255.255.255 UGH 0 0 0 vlan2
138.199.67.149 80.XXX.YYY.1 255.255.255.255 UGH 0 0 0 vlan2
0.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 ppp0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
80.XXX.YYY.0 0.0.0.0 255.255.255.0 U 0 0 0 vlan2
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 ppp0
-t mangle:
iptables --list -t mangle -nv
Chain PREROUTING (policy ACCEPT 12M packets, 12G bytes)
pkts bytes target prot opt in out source destination
133 12722 MARK udp -- * * 10.8.0.0/24 0.0.0.0/0 MARK set 0x1
1598 333K MARK udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:21194 MARK set 0x1
0 0 MARK udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:21194 MARK set 0x1
0 0 MARK tcp -- * * 192.168.1.104 0.0.0.0/0 tcp spt:21 MARK set 0x1
0 0 MARK tcp -- * * 192.168.1.104 0.0.0.0/0 tcp spts:52100:52150 MARK set 0x1
0 0 MARK tcp -- * * 192.168.1.104 0.0.0.0/0 tcp spt:21194 MARK set 0x1
0 0 MARK tcp -- * * 192.168.1.104 0.0.0.0/0 tcp spt:22 MARK set 0x1
5576 8268K MARK tcp -- * * 192.168.1.105 0.0.0.0/0 tcp spt:5000 MARK set 0x1
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21194 MARK set 0x1
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21194 MARK set 0x1
iptables --list FORWARD -nv
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
3541 200K TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 ACCEPT 0 -- ppp0 * 0.0.0.0/24 0.0.0.0/0
0 0 ACCEPT 0 -- * ppp0 0.0.0.0/0 0.0.0.0/24
4195K 198M lan2wan 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
15M 16G ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3507 187K TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 world tcp -- vlan2 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3689
0 0 world tcp -- vlan2 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
0 0 world tcp -- vlan2 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 world tcp -- vlan2 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:52100:52150
0 0 ACCEPT 47 -- * vlan2 192.168.1.0/24 0.0.0.0/0
0 0 ACCEPT tcp -- * vlan2 192.168.1.0/24 0.0.0.0/0 tcp dpt:1723
1 40 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.104 tcp dpt:21
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.104 tcp dpt:22
32 1904 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.105 tcp dpt:5000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.104 tcp dpts:52100:52150
0 0 TRIGGER 0 -- vlan2 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0
3942 238K trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
3942 238K ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
