Hello,
I want to setup bandwidth restrictions for a few clients that use openvpn to
connect to my server. I'm using iptables to mark the packets in the mangle
table (PRE/POSTROUTING) on eth0 before they get sent via the tunnel. Will the
mark survive even if the packets then get routed via an openvpn tunnel (tunX)
out the box or does openvpn change it removing the mark ?
openVPN is just a userspace process that - depending on configuration -
doesn't even need root access to run. (provided the device nodes are set
up accordingly).
Depending on what you do, the mark should survive (never tested this),
or not.
If you are just forwarding to a tun/tap, the mark should survive like
usual. There is no difference between a tun/tap device and another
ethernet device with regard to this point.
However, once a packet reaches the tun/tap, it gets transfered to
openVPN which encrypts it and sends it out using udp (or tcp, depending
on configuration) of a real interface. These outgoing packets are not
having the mark on them, primarily because they are completely different
packets that were generated by openVPN and not really directly related
to what went into the tun/tap device. I suspect that is however what
you'd like to achieve. Note that openVPN does has its own shaping
directive (--shaper n) which may help you in this case.
--
C U
- -- - -/\/ René Gallati \/\ - --- -- -
___
LARTC mailing list / [EMAIL PROTECTED]
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
