All routing is based on destination, which must be either an IP address or an interface. I.e. either "send all traffic with destination address a.b.c.d to e.f.g.h" or "send all traffic with destination address a.b.c.d out from interface X". It's not possible to create a rule "send all traffic received from interface A to interface B&...
You can do that with ss command on Linux.
I used it on Debian 10 and Ubuntu 20.04.
Here is the command:
ss --extended --processes --ipv4 -o state all '( dport = :ssh )'
This command list processes initiating connection to port 22 from the machine.
That is it. Read ss man for detail.
Iptables rules should only redirect traffic to shadowsocks if shadowsocks is running. This is not something that is done with iptables as it only handles traffic packets. Instead, a script is needed to control the shadowsocks service and iptables rules.
An example of a script for handling shadowsocks and iptables:
The entry in your OpenVPN configuration file that's responsible for handling the default routing is this one
It tells the OpenVPN client to redirect all traffic through the OpenVPN gateway.
If you want to control which routes are sent through the OpenVPN tunnel the keyword is route. It can be repeated multiple times, once per subnet. ...
TPROXY is intended for intercepting routed traffic (and with tinkering even doing it on a bridge). It can handle TCP or UDP, but not ICMP.
OP hints that the system is a final node receiving traffic rather than a router. Then all these complex settings that don't even achieve the goal are not needed.
Remove all previous alterations (iptables, ip rule, ip ...
I've been brainstorming over this issue and I've figured out what's going wrong.
A packet, first, goes through the mangle table, then goes to the nat table to have the nat rules applied on the packet (I use MASQUERADE for that).
We can easily differentiate traffic coming from 10.10.10.214 and make it bypass the transparent proxy:
iptables -t mangle -I ...