Oh, now it is clear. The responce packets are return by default route if the source address does not lay on the same IP mask as eth0. First fouthg is using iptables tagging and using rerouting by the source of the packet. I don't know exactly the write writting of the rule, but it must look something like this:
route 1, tagging packets:
iptables -i eth0 --dport [all the ports of the local services] --tag [tagname]
route 2, rerouting by tagname:
iptables --tag [tagname] --destination-gateway x.x.x.x[gw of eth0]
But I don't know if services will respond with packets with the same tagname. So I think about another resolution: SNATing the internet on the INPUT (or MANGLE) table:
iptables -i eth0 --dport [all the ports of the local services] --SNAT [ip of eth0]
So the service will respond to the IP of the eth0 and not transmit to tun-adapter. Using in rules only the ports of local services is benefit by limiting the purpose and adding security if someone will probe a non use port and something is responding, it will respond thru tunnel, so the attacker will never get responce.
