I have a php / bash application on top of a Linux machine with 1 physical interface connecting to e.g., outbound webserver 123.123.123.123 :80. I do this via several openvpn providers. I have both tun and tap providers, but my favorite provider uses tun.Actually I'm perfectly able to serially:open the vpnsudo route add 123.123.123.123 tun0send traffic to 123.123.123.123 :80close the vpnsudo route del 123.123.123.123I use the route-nopull option inside the .ovpn config file in order to keep the Linux machine reachable and allow simultaneous openvpn connections.Now I need to open several independent requests, always to outbound webserver 123.123.123.123 :80. But my actual flow is serial and I need to wait the first connection to close and clear itself before attempting a second connection.I'm quite sure that I can achieve it mangling with fake ports. Eg:interfaces tun0, tun1, tun2fake ports 9000, 9001, 9002multiple routing tables rt0, rt1, rt2So conceptually speaking:123.123.123.123:9000 -> mark for rt0 (tun0 is default gateway) -> rewrite as 123.123.123.123:80 -> rt0123.123.123.123:9001 -> mark for rt1 (tun1 is default gateway) -> rewrite as 123.123.123.123:80 -> rt1123.123.123.123:9002 -> mark for rt2 (tun2 is default gateway) -> rewrite as 123.123.123.123:80 -> rt2I can only represent the concept because I have almost no skills on iptables.If you have different ways to achieve the result, they're welcome.Thank you for reading and helping.
route on specific interface based on port
linux;iptables;openvpn;route
I solved and documented it here:http://aftermanict.blogspot.it/2015/11/bash-iptables-iproute2-and-multiple.htmlThis will make the kernel permanently route packets, enables multiple routes and even for networks not attested on the machine:nano /etc/sysctl.confnet.ipv4.conf.default.rp_filter = 2net.ipv4.conf.all.rp_filter = 2net.ipv4.ip_forward = 1for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 >| $f ; doneThis will initialize iptables and in particular mangle and nat, which are needed for marking the traffic:iptables -Fiptables -t nat -Fiptables -t mangle -Fiptables -Xadd the alternative routes editing:nano /etc/iproute2/rt_tablesAdd (names are your references):1 tunnel02 tunnel1add routes and rules, we use tables IDs instead of names which are more immediate. As you can notice, the gateway is irrelevant, especially for tunnels which can have dynamic gateways:ip route add 0.0.0.0/0 dev tun0 table 1ip route add 0.0.0.0/0 dev tun1 table 2add rules to mark traffic and bind to the corresponding table:ip rule add from all fwmark 1 table 1ip rule add from all fwmark 2 table 2ip route flush cachecheck if you like:ip route show table 1ip route show table 2ip rule showif you miss something, you can delete this way:ip rule del table 1ip route flush table 1NOW THE MISSING PART:THIS WONT WORK:iptables -A PREROUTING -t mangle -p tcp --dport 80 -j MARK --set-mark 1THIS WILL:iptables -A OUTPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 1iptables-saveDo you need to select traffic and push it simultaneously in a device / tunnel? No problem, I solved this too:iptables -A OUTPUT -t mangle -p tcp --dport 10001 -j MARK --set-mark 1iptables -A OUTPUT -t mangle -p tcp --dport 10002 -j MARK --set-mark 2iptables -t nat -A OUTPUT -p tcp --dport 10001 -j DNAT --to :80iptables -t nat -A OUTPUT -p tcp --dport 10002 -j DNAT --to :80NAT mandatory for replyiptables -t nat -A POSTROUTING -o $DEV1 -j MASQUERADEiptables -t nat -A POSTROUTING -o $DEV2 -j MASQUERADEiptables-save