iptables port based routing

Question

I've been Googling this for days with no success. I connect to a VPN from my server from time to time and I'm trying to configure my Debian server to only use port 80 and 443 through the VPN and all other ports through eth0 interface.

Any help to do this is highly appreciated.

Answer 1

First, see this guide: http://lartc.org/howto/lartc.rpdb.multiple-links.html (and/or other guides for using multiple default routes)

So in your case, I think the solution would be configure two network interfaces (the default eth0 and e.g. eth0:1 with a different valid ip from your lan) for your server, then configure routes so that by default all traffic go to the vpn, and traffic originating from the secondary interface stays off the vpn. Then with ssh bind to the secondary interface with the -b option.

OR set up the multiple routes so that traffic from the secondary interface goes to the vpn, then set up a www proxy server that is bound (only) to the secondary ip address. Then use that proxy server with the browsers.

OR if you use (only) wget, do the above and use the --bind-address option to bind to the secondary interface.

OR a less general solution, as as laurent commented on Dec 20 on the other answer, you can configure an ip specific route for the servers you're connecting to, without fiddling with multiple routing tables. Like this:

route add -host [the host you're connecting to] gateway [your gateway address]

Here's a real world example. I have a vpn connection set up, the vpn address is 23.21.xxx.yyy and my local external address is 91.157.xxx.yyy, and my local internal gateway address is 192.168.0.1.

root@dell64:~# curl -s ipchicken.com|egrep '[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+.*<br>'|sed 's/[0-9][0-9]*[.][0-9][0-9]* .*/xxx.yyy/'
        23.21.xxx.yyy
root@dell64:~# route add -host ipchicken.com gateway 192.168.0.1
root@dell64:~# curl -s ipchicken.com|egrep '[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+.*<br>'|sed 's/[0-9][0-9]*[.][0-9][0-9]* .*/xxx.yyy/'
        91.157.xxx.yyy

(ipchicken.com website just displays your external ip address, and the grep filters just the line with the external ip address, and the sed replaces the last parts with xxx.yyy)

Answer 2

If by "use" you mean receiving requests and serving sites, you need to configure Apache (or your webserver) to do that with Listen vpnIP:80 and Listen vpnIP:443. So it won't work on the other IPs.

Additionally using iptables, you can DROP port 80 and 443 for eth0 and only allow on the VPN interface (I used tun0 below) with;

-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j DROP
-A INPUT -i tun0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 443 -j ACCEPT

If by "use" you mean outgoing connection (surfing the web), one way is to install a proxy (like squid) on the server (or somewhere within the VPN) and configure the proxy to send all traffic trhough VPN default gateway. You can use iptables NAT table to redirect port 80 and 443 to the proxy port (3128 for squid) using:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.1.2:3128
iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Assuming:

tun0 = vpn interface
192.168.1.2 = IP of your server on tun0 (vpn)

And do the same for port 443.

Needs some testing and adjustments probably but this is the general behavior if going this way.