Iptables route specific port outside VPN (Tomato router firmware)

Question

Im trying to configure my router to what I feel is the perfect setup for me. I have managed to connect the router to my VPN-provider (PIA), and routed such that only one computer connects through VPN via iptables (see answere #4 https://serverfault.com/questions/382498/howto-only-tunnel-specific-hosts-route-through-openvpn-client-on-tomato). Im have not any previous experience with IPtables,

I do some gaming, and then the extra latency by using a VPN is undesired. How can I route the specific gaming ports to go directly through my WAN without VPN.

I did find this guide (First answere http://www.linksysinfo.org/index.php?threads/route-only-specific-ports-through-vpn-openvpn.37240/), but I dont manage to apply that to my situation.

My current IPTable script is this, which only route the correct computer through vpn.

sleep 30
ip route flush table 200
ip route flush cache
ip rule add from 192.168.1.143 lookup 200
VPN_GW=`ifconfig tun11 | awk '/inet addr/ {split ($2,A,":"); print A[2]}'`
ip route add table 200 default via $VPN_GW dev tun11

So how do I expand this such that the vpn computer (.143) uses direct connection for trafic on port 27000:27050 ?

Answer 1

First add an iptables rule to mark specific packets:

iptables -t mangle -A PREROUTING -p tcp --dport 27000:27050 -j MARK --set-mark 0x200
iptables -t mangle -A PREROUTING -p udp --dport 27000:27050 -j MARK --set-mark 0x200

(You didn't specify whether you want TCP ports or UDP ports, so here are both.)

Then add a policy routing rule that matches the mark:

ip rule add fwmark 0x200 lookup main

There are other possible combinations – for example, mark all packets meant for VPN (making the existing from rule unnecessary).