stateful iptables vs. ip rules policy routing dillemma...

[nasaiya]

Hello,

This one has me rather stumped, I hope someone might be willing to help me figure it out!

So in a normal stateful iptables configuration, doing something like "iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT" would make normal connections work. With OUTPUT traffic restricted by default the same would apply to the OUTPUT table. This much makes sense to me.

Now I have a policy based routing setup which takes outbound traffic and fwmarks them 1 or 2 depending on the rules they match, and the 1's are then sent to a different routing table with a default route that sends them out a tun interface while the 2's get the regular default route out eth0. In fact all traffic not specifically marked as a 2 gets treated as a 1 (route out the tun). Herein lies my problem.

If were to run say an openvpn server on eth0, the stateful rules above will allow such connections to work, however the RELATED/ESTABLISHED response packets responding to the initial connection request still hit the fwmark rules (in MANGLE) and get marked to go out the tun interface (the default) which makes the connection fail.

In other words something like this happens (assuming I'm understanding correctly):
(Pardon my ascii art... I was never an artist )

[papahuhn]