1

I'm trying to make use of cgroups to force certain applications to bypass my VPN. While it is working for the most part I'm having a little trouble with DNS queries.

The VPN configures only the filter table:

*filter
:INPUT ACCEPT [7374:4303108]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6573:2344795]
:xvpn - [0:0]
:xvpn_dns - [0:0]
:xvpn_dns_iface_exceptions - [0:0]
:xvpn_dns_ip_exceptions - [0:0]
:xvpn_ks - [0:0]
:xvpn_ks_iface_exceptions - [0:0]
:xvpn_ks_ip_exceptions - [0:0]
-A OUTPUT -j xvpn
-A xvpn -j xvpn_dns
-A xvpn -j xvpn_ks
-A xvpn_dns -j xvpn_dns_iface_exceptions
-A xvpn_dns -j xvpn_dns_ip_exceptions
-A xvpn_dns ! -o lo -p udp -m udp --dport 53 -j DROP
-A xvpn_dns_ip_exceptions -d 10.63.0.1/32 -p udp -m udp --dport 53 -j ACCEPT
-A xvpn_ks -j xvpn_ks_iface_exceptions
-A xvpn_ks -j xvpn_ks_ip_exceptions

With my limited understanding, I see that it should allow queries to both lo and 10.63.0.1. The VPN also configures /etc/resolv.conf. I have dnsmasq running locally and would like non VPN traffic to use it.

I'm setting up my cgroup with:

iptables -t mangle -A OUTPUT -m cgroup --cgroup 0x00110011 \
    -j MARK --set-mark 11
iptables -t nat -A OUTPUT -m cgroup --cgroup 0x00110011 -p udp --dport 53 \
    -j DNAT --to-destination 127.0.0.1:53
iptables -t nat -A POSTROUTING -m cgroup --cgroup 0x00110011 -o enp6s0 \
    -j MASQUERADE

ip rule add fwmark 11 table novpn
ip route add default via 192.168.2.1 table novpn

DNS queries from the cgroup are not resolving. However, if I modify the filter table to accept, it will work.

iptables -t filter -I OUTPUT -m cgroup --cgroup 0x00110011 -j ACCEPT

I'm guessing, but may be wrong, that even though the packets destination IP has changed from 10.63.0.1 (coming from /etc/resolv.conf) to 127.0.0.1, it is still using the target interface of enp6s0 rather than lo. I don't know how to confirm this.

I'd like to be able connect/disconnect my VPN, which overwrites the filter table each time, without affecting the cgroup traffic. How can I do this? Is there any way to set the DNS query to use lo before entering the filter table?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.