I'm trying to make use of
cgroups to force certain applications to bypass my VPN. While it is working for the most part I'm having a little trouble with DNS queries.
The VPN configures only the
*filter :INPUT ACCEPT [7374:4303108] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [6573:2344795] :xvpn - [0:0] :xvpn_dns - [0:0] :xvpn_dns_iface_exceptions - [0:0] :xvpn_dns_ip_exceptions - [0:0] :xvpn_ks - [0:0] :xvpn_ks_iface_exceptions - [0:0] :xvpn_ks_ip_exceptions - [0:0] -A OUTPUT -j xvpn -A xvpn -j xvpn_dns -A xvpn -j xvpn_ks -A xvpn_dns -j xvpn_dns_iface_exceptions -A xvpn_dns -j xvpn_dns_ip_exceptions -A xvpn_dns ! -o lo -p udp -m udp --dport 53 -j DROP -A xvpn_dns_ip_exceptions -d 10.63.0.1/32 -p udp -m udp --dport 53 -j ACCEPT -A xvpn_ks -j xvpn_ks_iface_exceptions -A xvpn_ks -j xvpn_ks_ip_exceptions
With my limited understanding, I see that it should allow queries to both
10.63.0.1. The VPN also configures
/etc/resolv.conf. I have
dnsmasq running locally and would like non VPN traffic to use it.
I'm setting up my
iptables -t mangle -A OUTPUT -m cgroup --cgroup 0x00110011 \ -j MARK --set-mark 11 iptables -t nat -A OUTPUT -m cgroup --cgroup 0x00110011 -p udp --dport 53 \ -j DNAT --to-destination 127.0.0.1:53 iptables -t nat -A POSTROUTING -m cgroup --cgroup 0x00110011 -o enp6s0 \ -j MASQUERADE ip rule add fwmark 11 table novpn ip route add default via 192.168.2.1 table novpn
DNS queries from the cgroup are not resolving. However, if I modify the filter table to accept, it will work.
iptables -t filter -I OUTPUT -m cgroup --cgroup 0x00110011 -j ACCEPT
I'm guessing, but may be wrong, that even though the packets destination IP has changed from
10.63.0.1 (coming from /etc/resolv.conf) to
127.0.0.1, it is still using the target interface of
enp6s0 rather than
lo. I don't know how to confirm this.
I'd like to be able connect/disconnect my VPN, which overwrites the filter table each time, without affecting the cgroup traffic. How can I do this? Is there any way to set the DNS query to use
lo before entering the filter table?