My home DD-WRT router has several interfaces among which:

  • eth0: ISP WAN
  • eth1: LAN
  • tun0: open vpn client setup on VPN provider private internet access

I host NAS "Joe" on the LAN, reachable from internet on port 12345 thanks to port forwarding (AKA D-NAT). Prior to setting tun0 on the DD-WRT, this worked fine.

Now, on the DD-WRT, "Joe" is setup to go through tun0.

Hence, when I connect to Joe:12345 from the internet, the following happens:

  1. Joe receives TCP SYN packet
  2. Joe replies, sends as TCP ACK packet to the initiator
  3. Problem: DD-WRT routes the TCP ACK to tun0, instead of eth0
  4. Initiator connection is never acknowledged

My idea is to use IP tables to be able to direct the TCP packets correctly, i.e.:

  • "Joe" TCP connection initated from eth0: replied through eth0 (instead of tun0)
  • other traffic from "Joe": routed through tun0

I'm looking into packet marking with ip tables, to no avail so far. How can I fix this interface routing problem?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.