My home DD-WRT router has several interfaces among which:
- eth0: ISP WAN
- eth1: LAN
- tun0: open vpn client setup on VPN provider private internet access
I host NAS "Joe" on the LAN, reachable from internet on port 12345 thanks to port forwarding (AKA D-NAT). Prior to setting tun0 on the DD-WRT, this worked fine.
Now, on the DD-WRT, "Joe" is setup to go through tun0.
Hence, when I connect to Joe:12345 from the internet, the following happens:
- Joe receives TCP SYN packet
- Joe replies, sends as TCP ACK packet to the initiator
- Problem: DD-WRT routes the TCP ACK to tun0, instead of eth0
- Initiator connection is never acknowledged
My idea is to use IP tables to be able to direct the TCP packets correctly, i.e.:
- "Joe" TCP connection initated from eth0: replied through eth0 (instead of tun0)
- other traffic from "Joe": routed through tun0
I'm looking into packet marking with ip tables, to no avail so far. How can I fix this interface routing problem?