iptables directing traffic through vpn

Question

Networking newbie. I have two interfaces on the host: eth0 and tun0 from my OpenVPN client. The IP addresses are:

eth0    192.168.1.22
tun0    10.1.0.8

Question 1

For outgoing traffic by changing the destination address to that of tun0 will it force it to use the vpn?

No, but using gateway address for tun0 does. Tested with the following:

    iptables -t nat -N VPN
    iptables -t nat -I OUTPUT -j VPN
    iptables -t nat -A VPN -p tcp -j DNAT --to-destination 10.1.0.170

Where 10.1.0.170 was the gateway address for VPN (found using ip route).

1. The above example creates a NEW (-N) chain for the nat table (-t).
2. The jump to the VPN chain is from OUT (straight after local app). Using insert (-I) to supersede other rules in OUT.
3. It's implied that for traffic originating from any source change destination to gateway of tun0 device.

Question 2(a)

For outbound traffic is the destination address the IP address of the interface eth0 or is it the gateway address? Assuming eth0 is default interface/gateway.

Question 2(b)

For traffic generated from local app what is the source address?

Question 3

Can this be solved purely by iptables or do I need to modify the routing table? As both interfaces are on the same host (i.e. same debian box).

Additional Info

I'm trying to understand the principles so I can apply it to my case. There are three I address subnets in total, the third is in the range 172.17.42.1/16 associated with another virtual interface docker0.

Essentially I want to direct traffic from just 172.17.42.8 via the VPN.

Answer 1

First and foremost the excellent figure linked from the ArchLinux wiki iptables page is useful in identifying packet flow through the various iptables chains (at the bottom of the answer).

Backup

iptables-save > back.up.file

Check for your flavor of Linux distribution, I needed to add sudo as I wasn't root.

Question 2(a), 2(b)

To determine source and destinaton addresses I found the LOG and TRACE functions very useful:

iptables -t filter -I OUTPUT -m limit --limit 5/m --limit-burst 10 -j LOG  --log-prefix "ABC-LOG-PREFIX "

The default table is filter but I've stated it explicitly so you can see syntax, especially if you want to explore other tables mangle, nat etc. I've inserted the rule -I because I wanted packets to be logged before other rules were applied. Added a rate limit so log file doesn't become saturated -m limit --limit 5/m --limit-burst 10. Finally added a prefix so log file can be searched easily --log-prefix. For example, on Linux Mint:

cat /var/log/kern.log | grep "ABC-LOG-PREFIX"

Secondly for debugging, the TRACE command will track a packet through the entire process:

IPTABLES -t raw -A PREROUTING -p tcp -j TRACE

Warning, this will trace all tcp packets, for more info see Admin Berlin

Question 3

As both interfaces (eth0 and tun0) were on same host, from the packet filter diagram below you can see for outbound traffic they start at the same point. Which route a packet takes is determined by the default gateway and its associated interface, which can be determined using iproute2 by running:

ip route

This will show default gateway, which interfaces are used for what address ranges.

Packet Flow Diagram

Answer 2

From what I can tell, you're talking about split-tunneling (or rather, trying to disable it).

Take a look at the redirect-gateway directive in OpenVPN: https://openvpn.net/index.php/open-source/documentation/howto.html#redirect

Answer 3

In the following examples the vpn device name is tun0 (OpenVPN) and the VPN gateway is 172.21.23.172

#1 - Install VPN on your Linux router (I'm using ipvanish w. openvpn)

#2 - Route traffic using iptables

sudo iptables -t nat -A POSTROUTING -o [VPN dev] -j MASQUERADE

example:

sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

#3 - Configure routing tables (to ensure that all traffic is routed through the VPN)

sudo ip route add default via [VPN ipv4 address] dev [VPN dev]

example:

sudo ip route add default via 172.21.23.172 dev tun0

#4 - Check that devices on the network are indeed routing thru the VPN by running these commands:

Windows:tracert 1.1.1.1 Linux:traceroute 1.1.1.1

you're done!