I am using a Raspberry Pi 3 as a WiFi access point, which routes all traffic through the tun0 interface/OpenVPN. However, I'd like to be able to route traffic from a device with the IP on the network through eth0 interface to bypass the VPN. I have tried marking packets, and routing those packets using a table with a rule to route through eth0 as follows:

iptables -A FORWARD -s -j MARK --set-mark 11
ip rule add fwmark 11 table 3
ip route add default via table 3

However, even when ip route get from iif eth0 mark 11 returned that it was being routed through eth0, the public IP of that device was still that of the VPN server.

The following is my kernel routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface       UG        0 0          0 tun0         UG        0 0          0 eth0 UGH       0 0          0 tun0 UH        0 0          0 tun0 UGH       0 0          0 eth0       UG        0 0          0 tun0   U         0 0          0 wlan0   U         0 0          0 eth0

My iptables rules are:

-A FORWARD -i tun0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o tun0 -j ACCEPT

in order to route traffic from wlan0 through the VPN.

Any ideas on how to route traffic from that local IP around the VPN would be appreciated.


1 Answer 1


Figured it out. Problem was that packets weren't being forwarded back through wlan0 when sent through eth0, so they never reached the device. I needed to configure the same iptables rules above for eth0 as well. What I ended up doing:

sudo ip rule add fwmark 3 table 3
sudo iptables -t mangle -A PREROUTING -s -j MARK --set-mark 3
sudo ip route add default via dev eth0 table 3
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.