On Wed, 14 Oct 2015 12:52:19 -0400, Selva Nair wrote:

> To test, keep it simple -- try with just one IP directly specified in
> the rule
> 
> # iptables -t mangle -I OUTPUT -d 8.8.8.8/32 -j MARK --set-mark 200
> 
> (to work locally this has to be in the OUTPUT chain -- see below)
> 
> # ip rule add fwmark 200 table openvpn
> 
> # ip rule show (make sure  there are no rules that may override this
> one)
> 
> # ip route flush table openvpn # ip route add default via
> <VPN-remote-IP-here> dev <vpn-tun-dev-here> table openvpn
> 
> # ip route list table openvpn
> 
> (review the route to be sure..)
> 
> Test the routing with and without this one in place

I've done all the above steps just as you have told above.

Finally, I gives the results here:

1- Without the route in table openvpn: 
$ ip route show table openvpn
$ 

This will let the routing to 8.8.8.8 via my default route on eth0, i.e., 
192.168.0.1

$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  192.168.0.1 (192.168.0.1)  0.563 ms  0.776 ms  1.006 ms
 2  10.136.3.254 (10.136.3.254)  2.836 ms  3.067 ms  3.384 ms
 3  10.136.255.252 (10.136.255.252)  2.878 ms  3.117 ms  3.343 ms
 4  10.241.255.250 (10.241.255.250)  3.594 ms  3.586 ms  3.814 ms
 5  10.255.255.248 (10.255.255.248)  3.066 ms  3.299 ms  3.533 ms
 6  60.6.238.1 (60.6.238.1)  4.185 ms  2.177 ms  7.459 ms
 7  60.6.37.37 (60.6.37.37)  7.722 ms  7.731 ms  7.718 ms
 8  60.6.43.133 (60.6.43.133)  7.309 ms 60.6.43.137 (60.6.43.137)  7.256 
ms 60.6.39.249 (60.6.39.249)  7.261 ms
 9  61.182.179.25 (61.182.179.25)  31.483 ms 61.182.178.233 
(61.182.178.233)  31.455 ms 61.182.179.25 (61.182.179.25)  31.465 ms
10  219.158.104.33 (219.158.104.33)  48.091 ms  48.288 ms  48.280 ms
11  219.158.11.34 (219.158.11.34)  57.035 ms 219.158.11.74 
(219.158.11.74)  52.226 ms 219.158.96.226 (219.158.96.226)  131.646 ms
12  219.158.96.250 (219.158.96.250)  49.595 ms 219.158.19.77 
(219.158.19.77)  82.537 ms 219.158.97.18 (219.158.97.18)  121.657 ms
13  219.158.3.238 (219.158.3.238)  141.312 ms  77.164 ms 219.158.102.122 
(219.158.102.122)  49.565 ms
14  72.14.215.130 (72.14.215.130)  50.217 ms  69.257 ms  55.246 ms
15  209.85.248.60 (209.85.248.60)  63.849 ms  63.350 ms  55.446 ms
16  216.239.40.11 (216.239.40.11)  119.944 ms 209.85.142.185 
(209.85.142.185)  128.612 ms 216.239.40.13 (216.239.40.13)  129.945 ms
17  209.85.253.89 (209.85.253.89)  143.922 ms 216.239.47.157 
(216.239.47.157)  81.569 ms  81.157 ms
18  209.85.243.23 (209.85.243.23)  82.409 ms  82.655 ms 209.85.243.21 
(209.85.243.21)  145.775 ms
19  * * *
20  google-public-dns-a.google.com (8.8.8.8)  156.322 ms  146.674 ms  
177.636 ms
werner@debian-01:~$ 

2- With the route in table openvpn: 

$ ip route show table openvpn
default via 10.211.1.34 dev tun-gfwlist

This time the following command will give nothing:


$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *


See my other configurations:

$ ip rule show
0:      from all lookup local 
32765:  from all fwmark 0xc8 lookup openvpn 
32766:  from all lookup main 
32767:  from all lookup default
$ sudo iptables-save 
# Generated by iptables-save v1.4.21 on Thu Oct 15 20:12:51 2015
*mangle
:PREROUTING ACCEPT [15372:2097840]
:INPUT ACCEPT [15372:2097840]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [23979:4105056]
:POSTROUTING ACCEPT [23979:4105056]
-A PREROUTING -i eth0 -j MARK --set-xmark 0x0/0xffffffff
-A PREROUTING -i tun0 -j MARK --set-xmark 0x0/0xffffffff
-A PREROUTING -i tun0 -j MARK --set-xmark 0x0/0xffffffff
-A OUTPUT -d 8.8.8.8/32 -j MARK --set-xmark 0xc8/0xffffffff
COMMIT
# Completed on Thu Oct 15 20:12:51 2015
# Generated by iptables-save v1.4.21 on Thu Oct 15 20:12:51 2015
*filter
:INPUT ACCEPT [24931:7199518]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [34265:5857128]
COMMIT
# Completed on Thu Oct 15 20:12:51 2015
$ sudo ifconfig 
eth0      Link encap:Ethernet  HWaddr 0c:c4:7a:6a:f7:f0  
          inet addr:192.168.0.2  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10602 errors:0 dropped:3 overruns:0 frame:0
          TX packets:19824 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3918823 (3.7 MiB)  TX bytes:4636215 (4.4 MiB)
          Memory:de200000-de27ffff 

eth1      Link encap:Ethernet  HWaddr 0c:c4:7a:6a:f7:f1  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Memory:de100000-de17ffff 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:11343 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11343 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1158233 (1.1 MiB)  TX bytes:1158233 (1.1 MiB)

tun-gfwlist Link encap:UNSPEC  HWaddr 
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.211.1.33  P-t-P:10.211.1.34  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:611 errors:0 dropped:0 overruns:0 frame:0
          TX packets:90 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:191187 (186.7 KiB)  TX bytes:5400 (5.2 KiB)


Furthermore, the following command will failed:

$ dig twitter.com @8.8.8.8

; <<>> DiG 9.9.5-9+deb8u2-Debian <<>> twitter.com @8.8.8.8
;; global options: +cmd
;; connection timed out; no servers could be reached

It's well known that the 8.8.8.8 is google's public DNS server.

If I do the following flush command:

$ sudo ip route flush table openvpn

And the dig command will show as follows:

$ dig twitter.com @8.8.8.8

; <<>> DiG 9.9.5-9+deb8u2-Debian <<>> twitter.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20908
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;twitter.com.                   IN      A

;; ANSWER SECTION:
twitter.com.            2900    IN      A       159.106.121.75

;; Query time: 56 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 15 20:16:07 CST 2015
;; MSG SIZE  rcvd: 56

This resolve result is erroneous due to the gfw's dns posioning of china.

But, I can get the correct result as follows:

$ dig twitter.com @8.8.8.8 +tcp

; <<>> DiG 9.9.5-9+deb8u2-Debian <<>> twitter.com @8.8.8.8 +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28998
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;twitter.com.                   IN      A

;; ANSWER SECTION:
twitter.com.            48      IN      A       104.244.42.1
twitter.com.            48      IN      A       104.244.42.129

;; Query time: 82 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 15 20:19:14 CST 2015
;; MSG SIZE  rcvd: 72

Any hints for the above issues?

Regards
-- 
.: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.


------------------------------------------------------------------------------
_______________________________________________
Openvpn-users mailing list
Openvpn-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-users

Reply via email to