Ttyjfyk

I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly

[localhost] -> [gateway] -> [remote] - OK

[localhost] <- [gateway] <- [remote] - packet dissappears after vpn tunnel. I am able to sniff that on tun0 iface, then it dissappears.

What I did:
added gw1 to rt_tables
then used this rules

ip route add default via 10.8.0.1 dev tun0 table gw1
ip rule add fwmark 0x1 table gw1
iptables -A OUTPUT -t mangle -o eth0 -p tcp --dport 443 -j MARK --set-mark 1
iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 443 -j SNAT --to 10.8.0.2
iptables -A OUTPUT -t mangle -o eth0 -p udp --dport 161 -j MARK --set-mark 1
iptables -A POSTROUTING -t nat -o tun0 -p udp --dport 161 -j SNAT --to 10.8.0.2

So I am testing tcp and udp connections and what I see:

• On remote side everything works correctly and packet is send back
  to gateway to eth0


• On gateway packet gets passed back to vpn tunnel (tun0)


• On localhost that sent that packet I see how packet arrive to
  10.8.0.2 (tun0) in tshark and then it dissapears. And localhost does TCP-retransmission or resends UDP packet.

I checked packet capture in wireshark and all ports are correct so it's using same random dynamic port during all that trasfer: back and forward. I also tried using masquerade on localhost instead of SNAT without any success.
Tried redirecting packets with DNAT to 127.0.0.1 with no success but I am not sure, maybe I'm doing anything wrong.

Why that packet dissapears after tun0? My input chain allows everything for now. Maybe I need to enable or disable any new "features" in sysctl.conf that I am not concerned about?

Thanks

My rules are correct

Solution:

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $f; done
echo 1 > /proc/sys/net/ipv4/route/flush 

Now everything is working fine. Note that you need to disable that on every iface, option "all" are not working fine.