masquerading lan to inet: how to not route thr[workedaround]

[equaeghe]

Hi,

I have a computer connected to the internet (inet=eth0) via an adsl modem. I have a second network interface connected to a second computer (lan=eth1) to share the internet connection (via NAT/masquerading/port forwarding). This works nicely as such.

However, I use a vpn (vpn) to my work (reroutes only traffic to my work's ip-range) and when this vpn is active, the other computer's internet access the (public) parts of my works network (i.e., their www, webmail,...). This problem can be circumvented by also rerouting this traffic via the vpn connection (again via NAT/masquerading/port forwarding). Due to the instability of the vpn connection and the fact that the user of the lan computer has no access rights to the vpn setup (and I do not want the to have it), this situation is not ideal.

I would like to reroute _all_ the traffic to my internet connection (inet) from the lan, also for my work's ip range (the second computer is responsible for setting up it's own vpn) and not let anything go through the vpn. How do I go about this?

Side info:
* routing info:

[Hu]

To be clear, you want the internal machine never to access any IP address on the WorkVPN range, correct?

I think all you need here is: iptables -A FORWARD -s 192.168.1.0/24 -d WorkIPRange/WorkNetmask -j REJECT. Be sure that you add that rule high enough that it is hit before the rule which grants the internal computer access to the Internet. The FORWARD chain is not used for traffic originating on the machine itself, so your access to WorkIPRange is unaffected even though you have an address that matches 192.168.1.0/24. If that does not have the desired effect, it would be very helpful to see the output of iptables-save -c with that rule added. Mask the work IP range if you like.

[equaeghe]

[Hu]

I see. You want to use "source routing" which requires the kernel feature CONFIG_IP_MULTIPLE_TABLES. Look in net/ipv4 for "IP: policy routing".

[equaeghe]