1

I've setup openvpn client on my dd-wrt to connect to a host a couple states away. Works great(checked route table as well) but I want to only tunnel http traffic. I've always used IPtables for my dd-wrt router. Here is what I have, but it doesn't seem to work:

iptables -I FORWARD 1 -p tcp -m multiport --dports 80 -o tun1 -j ACCEPT
iptables -I FORWARD 2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 3 -j DROP

I've also heard that I should use policy based routing, but I really don't know why/how?. I would think that IP tables would work. So any help on why the above will not work would be awesome.

Thanks!

Improve this question
1

So what you want is to route dport 80 to the tunnel interface and everything else to the outgoing ethernet untunneled?

You can't do that with iptables, at least not by default. iptables can drop, permit, and alter or change packets. iptables doesn't normally make routing decisions. In fact, by the time a packet is being evaluated by the FORWARD table, the routing decision has already been made. That's why you can use the outgoing interface as a parameter; it's already been determined.

The rules you have posted here just drops anything not on port 80 and on the tunnel. It might even drop the tunnel, but I think that'd be handled by OUTPUT instead.

Policy based routing is well beyond my expertise, and even some quick googling turns up multiple ways to implement it. Roughly speaking though, if this is the way you want it to work, you're always going to be adding rules to the PREROUTING table. Here's a doc that describes a patch to iptables so it adds a target to alter routes directly. Here's a section of an advanced routing document that uses iptables to tag packets and sets up the routing table to operate via the tags. There's more still (google "policy based routing using iptables"), and I have unfortunately no idea how much of this is workable with DD-WRT. Hopefully this can give you a beginning of help to scale the rabbit hole.

Improve this answer
  • Yes that's what I want – Benjamin Jones Dec 2 '15 at 0:06
  • I was thinking about using a ssh client(ddwrt?) Dynamic forwarding port 80 and using socks. But I don't think ddwrt can do that. To me ssh would make more sense but everyone has been telling me vpn but not how. Thanks again for your help . – Benjamin Jones Dec 2 '15 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.