1
1
inexperienced sysadmin here.
I'm planning on running a net daemon inside a FreeBSD jail through OpenVPN, but want to be able to SSH directly into the jail and use the daemon's web interface daemon without going through the VPN. As I understand it, an OpenVPN tunnel is normally set up as a default virtual internet interface, and so incoming traffic will go out on the OpenVPN interface by default (which is problematic, as this incurs latency).
I thought "well, obviously, since all of this traffic is leaving on a handful of ports, I'll just redirect those to the non-VPN gateway." I've tried to look for solutions, but almost all of them involve iptables instead of ipfw (which is default for FreeBSD) and solve slightly different problems. And alternate solutions like using multiple default routes to ensure that incoming traffic on any interface is always sent out on the same interface seem far-reaching and require deep knowledge of all tools involved.
Is there an elegant way of ensuring that traffic leaving on specific ports exits on a specified non-default interface using ipfw?
Thanks! I'm curious, though (although I'll take what you say at face value): is there any documentation I can read that would tell me that TCP connections are bound to interfaces? I did some light Googling of relevant documentation but I'm still not sure how I could have predicted that myself. – Polygonica – 2014-08-23T10:03:17.523
It’s by definition: A TCP endpoint is defined by IP address and TCP port. TCP endpoints in a connection are fixed, as a connection is defined by two endpoints. In all but special configurations, every IP interface on a machine has a unique IP address. So unless making a new connection, everything is fixed. – Daniel B – 2014-08-23T10:31:48.880