Несколько таблиц маршрутизации

ip route add 192.168.1.0/24 dev eth1 table myinet

ip route | grep -v via

[my client] -> [my server] -> [provider] -> [my vpn] -> [site:80] 

[my client] -> [my server] -> [provider] -> [site:!80]

tcpdump -i eth0 -nn -p -e "(port 80) and (host $test_vps_ip)"

tcpdump -i tun0 -nn -p -e "(port 80) and (host $test_vps_ip)"

telnet $test_vps_ip 80
Trying $test_vps_ip...
telnet: Unable to connect to remote host: Connection timed out

19:09:39.833634  ethertype IPv4 (0x0800), length 74: $my_external_ip.33898 > $test_vps_ip.80: Flags [S], seq 1810718277, win 29200, options [mss 1460,sackOK,TS val 619778817 ecr 0,nop,wscale 7], length 0
19:09:39.884527  ethertype IPv4 (0x0800), length 74: $test_vps_ip.80 > $my_external_ip.33898: Flags [S.], seq 3700842918, ack 1810718278, win 28960, options [mss 1460,sackOK,TS val 1191850 ecr 619778817,nop,wscale 8], length 0
19:09:40.833251  ethertype IPv4 (0x0800), length 74: $my_external_ip.33898 > $test_vps_ip.80: Flags [S], seq 1810718277, win 29200, options [mss 1460,sackOK,TS val 619779067 ecr 0,nop,wscale 7], length 0
19:09:40.885346  ethertype IPv4 (0x0800), length 74: $test_vps_ip.80 > $my_external_ip.33898: Flags [S.], seq 3700842918, ack 1810718278, win 28960, options [mss 1460,sackOK,TS val 1192100 ecr 619778817,nop,wscale 8], length 0
...

telnet $test_vps_ip 80
Trying $test_vps_ip...
Connected to $test_vps_ip.
Escape character is '^]'.

19:22:11.311907 ip: $tun0_ip.33992 > $test_vps_ip.80: Flags [S], seq 1762637369, win 29200, options [mss 1460,sackOK,TS val 619966695 ecr 0,nop,wscale 7], length 0
19:22:11.363531 ip: $test_vps_ip.80 > $tun0_ip.33992: Flags [S.], seq 3911398556, ack 1762637370, win 28960, options [mss 1352,sackOK,TS val 1379720 ecr 619966695,nop,wscale 8], length 0
19:22:11.363676 ip: $tun0_ip.33992 > $test_vps_ip.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 619966708 ecr 1379720], length 0

iptables -t mangle -A PREROUTING -i eth0 -p tcp --sport 80 -j MARK --set-mark 1

iptables -A PREROUTING -t mangle -i eth1 -p tcp --dport 80 -j MARK --set-mark 1

echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter

ip rule
0:      from all lookup local 
32762:  from all fwmark 0x1 lookup myinet
32766:  from all lookup main 
32767:  from all lookup default 

ip route show table main
default via $tun0_ip dev tun0  scope link 
$eth1_net/24 dev eth0  proto kernel  scope link  src $eth1_ip
$vpn_ip via $inet_gate dev eth0 
$eth0_net/24 dev eth1  proto kernel  scope link  src $eth0_ip

ip route show table myinet
default via $inet_gate dev eth0 

iptables-save
*mangle
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff
-A PREROUTING -i eth0 -p tcp -m tcp --sport 80 -j MARK --set-xmark 0x1/0xffffffff

*nat
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.0/24 -o tun0 -j MASQUERADE

ip route add $eth1_net/24 dev eth1 table myinet

$my_external_ip.33904 > $test_vps_ip.80: Flags [S]
$test_vps_ip.80 > $my_external_ip.33904: Flags [S.]

#!/bin/bash

eth_inet=eth0
eth_lan=eth1
tun_vpn=tun0

inet_gate_ip=
vpn_local_ip=
vpn_inet_ip=
eth_lan_ip=

table_myinet=myinet
table_vpn=vpn

for iface in all $eth_inet $eth_lan $tun_vpn;
do
  echo "Setting rp_filter=0 for ${iface}"
  echo 0 > "/proc/sys/net/ipv4/conf/${iface}/rp_filter"
done

if [[ `grep "${table_myinet}" /etc/iproute2/rt_tables` == "" ]]; then echo 2 $table_myinet >> /etc/iproute2/rt_tables; fi
if [[ `grep "${table_vpn}"    /etc/iproute2/rt_tables` == "" ]]; then echo 3 $table_vpn    >> /etc/iproute2/rt_tables; fi

ip route flush table $table_myinet
ip route add $eth_lan_ip/24 dev eth1 table $table_myinet
ip route add default via $inet_gate_ip table $table_myinet
printf "\nip route show table ${table_myinet}:\n"
ip route show table $table_myinet

ip route flush table $table_vpn
ip route add $vpn_inet_ip via $inet_gate_ip dev eth0 table $table_vpn
ip route add default via $vpn_local_ip dev tun0  scope link table $table_vpn
ip route add $eth_lan_ip/24 dev eth1 table $table_vpn
printf "\nip route show table ${table_vpn}:\n"
ip route show table $table_vpn

ip rule del fwmark 1 lookup $table_myinet
ip rule add fwmark 1 lookup $table_myinet

ip rule del fwmark 2 lookup $table_vpn
ip rule add fwmark 2 lookup $table_vpn

printf "\nip rule show:\n"
ip rule show

ports=(80 443)
vpn_mark=2
eth_local=eth1

opt_delete_rules=false

while getopts "d" opt; 
do
  case "$opt" 
  in
    d)
      opt_delete_rules=true
      ;;
  esac
done

iptables-save | grep -v rule_port_over_vpn | iptables-restore

if [ $opt_delete_rules == true ]
then
  exit 0;
fi

for port in ${ports[@]}
do
  iptables -A PREROUTING -t mangle -i $eth_local -p tcp -m tcp --dport $port -j MARK --set-mark $vpn_mark -m comment --comment rule_port_over_vpn
done