Networking newbie. I have two interfaces on the host: eth0 and tun0 from my OpenVPN client. The IP addresses are:


Question 1

For outgoing traffic by changing the destination address to that of tun0 will it force it to use the vpn?

No, but using gateway address for tun0 does. Tested with the following:

    iptables -t nat -N VPN
    iptables -t nat -I OUTPUT -j VPN
    iptables -t nat -A VPN -p tcp -j DNAT --to-destination

Where was the gateway address for VPN (found using ip route).

  1. The above example creates a NEW (-N) chain for the nat table (-t).
  2. The jump to the VPN chain is from OUT (straight after local app). Using insert (-I) to supersede other rules in OUT.
  3. It's implied that for traffic originating from any source change destination to gateway of tun0 device.

Question 2(a)

For outbound traffic is the destination address the IP address of the interface eth0 or is it the gateway address? Assuming eth0 is default interface/gateway.

Question 2(b)

For traffic generated from local app what is the source address?

Question 3

Can this be solved purely by iptables or do I need to modify the routing table? As both interfaces are on the same host (i.e. same debian box).

Additional Info

I'm trying to understand the principles so I can apply it to my case. There are three I address subnets in total, the third is in the range associated with another virtual interface docker0.

Essentially I want to direct traffic from just via the VPN.

  • Why are you trying to solve this with iptables? A proper routing table is the way to go. – Daniel B May 14 '15 at 12:43
  • Because I'm ignorant! :) I've seen solutions were people have enabled ip forwarding and others where they've setup two different routing tables with respective default gateways. I don't know the 'right' way to do this but based on examples seen apparently should do it but seems too easy. – fswings May 14 '15 at 12:46
  • What are you actually trying to accomplish? Send all traffic to (or through your VPN? Or all your internet traffic? – Daniel B May 14 '15 at 12:50
  • I want all traffic from a specific ip address to go though vpn. I've seen lots of examples forwarding from vpn but not many to vpn using iptables. – fswings May 14 '15 at 12:51
  • Routing doesn’t work on source addresses, but destination addresses. If you want a specific client to use a VPN connection, this very client should establish its own VPN connection. – Daniel B May 14 '15 at 12:54

From what I can tell, you're talking about split-tunneling (or rather, trying to disable it).

Take a look at the redirect-gateway directive in OpenVPN: https://openvpn.net/index.php/open-source/documentation/howto.html#redirect

  • You are correct this isn't what I want. I've add more context to question. – fswings May 14 '15 at 12:58
  • See additional info. – fswings May 14 '15 at 13:07

First and foremost the excellent figure linked from the ArchLinux wiki iptables page is useful in identifying packet flow through the various iptables chains (at the bottom of the answer).


iptables-save > back.up.file

Check for your flavor of Linux distribution, I needed to add sudo as I wasn't root.

Question 2(a), 2(b)

To determine source and destinaton addresses I found the LOG and TRACE functions very useful:

iptables -t filter -I OUTPUT -m limit --limit 5/m --limit-burst 10 -j LOG  --log-prefix "ABC-LOG-PREFIX "

The default table is filter but I've stated it explicitly so you can see syntax, especially if you want to explore other tables mangle, nat etc. I've inserted the rule -I because I wanted packets to be logged before other rules were applied. Added a rate limit so log file doesn't become saturated -m limit --limit 5/m --limit-burst 10. Finally added a prefix so log file can be searched easily --log-prefix. For example, on Linux Mint:

cat /var/log/kern.log | grep "ABC-LOG-PREFIX"

Secondly for debugging, the TRACE command will track a packet through the entire process:


Warning, this will trace all tcp packets, for more info see Admin Berlin

Question 3

As both interfaces (eth0 and tun0) were on same host, from the packet filter diagram below you can see for outbound traffic they start at the same point. Which route a packet takes is determined by the default gateway and its associated interface, which can be determined using iproute2 by running:

ip route

This will show default gateway, which interfaces are used for what address ranges.

Packet Flow Diagram

iptables packet flow diagram

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.