Роутинг вроде все-таки правильный, сниффер ловит пакеты, при обращении куда-либо:
root@debserver:~# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 96 bytes
13:46:10.636232 IP 10.8.0.6.33523 > **.***.1.241.8000: Flags [S], seq 935179318, win 5840, options [mss 1366,sackOK,TS val 2803025 ecr 0,nop,wscale 6], length 0
13:46:10.768292 IP 10.8.0.6.33524 > **.***.1.241.8000: Flags [S], seq 985679284, win 5840, options [mss 1366,sackOK,TS val 2803039 ecr 0,nop,wscale 6], length 0
13:46:10.948176 IP 10.8.0.6.33525 > **.***.1.241.8000: Flags [S], seq 985356458, win 5840, options [mss 1366,sackOK,TS val 2803103 ecr 0,nop,wscale 6], length 0
13:46:13.692790 IP 10.8.0.6.33524 > **.***.1.241.8000: Flags [S], seq 985679284, win 5840, options [mss 1366,sackOK,TS val 2803789 ecr 0,nop,wscale 6], length 0
13:46:13.948573 IP 10.8.0.6.33525 > **.***.1.241.8000: Flags [S], seq 985356458, win 5840, options [mss 1366,sackOK,TS val 2803853 ecr 0,nop,wscale 6], length 0
13:46:15.575034 IP 10.8.0.6.33526 > **.***.1.241.8000: Flags [S], seq 1066250476, win 5840, options [mss 1366,sackOK,TS val 2804259 ecr 0,nop,wscale 6], length 0
13:46:15.825415 IP 10.8.0.6.33527 > **.***.1.241.8000: Flags [S], seq 1066210153, win 5840, options [mss 1366,sackOK,TS val 2804322 ecr 0,nop,wscale 6], length 0
13:46:18.574863 IP 10.8.0.6.33526 > **.***.1.241.8000: Flags [S], seq 1066250476, win 5840, options [mss 1366,sackOK,TS val 2805009 ecr 0,nop,wscale 6], length 0
13:46:18.826000 IP 10.8.0.6.33527 > **.***.1.241.8000: Flags [S], seq 1066210153, win 5840, options [mss 1366,sackOK,TS val 2805072 ecr 0,nop,wscale 6], length 0
13:46:19.950295 IP 10.8.0.6.33525 > **.***.1.241.8000: Flags [S], seq 985356458, win 5840, options [mss 1366,sackOK,TS val 2805353 ecr 0,nop,wscale 6], length 0
13:46:20.644937 IP 10.8.0.6.33528 > **.***.1.241.8000: Flags [S], seq 1132444148, win 5840, options [mss 1366,sackOK,TS val 2805526 ecr 0,nop,wscale 6], length 0
13:46:20.898549 IP 10.8.0.6.33529 > **.***.1.241.8000: Flags [S], seq 1145483146, win 5840, options [mss 1366,sackOK,TS val 2805590 ecr 0,nop,wscale 6], length 0
13:46:23.643846 IP 10.8.0.6.33528 > **.***.1.241.8000: Flags [S], seq 1132444148, win 5840, options [mss 1366,sackOK,TS val 2806276 ecr 0,nop,wscale 6], length 0
13:46:24.576152 IP 10.8.0.6.33526 > **.***.1.241.8000: Flags [S], seq 1066250476, win 5840, options [mss 1366,sackOK,TS val 2806509 ecr 0,nop,wscale 6], length 0
13:46:24.827257 IP 10.8.0.6.33527 > **.***.1.241.8000: Flags [S], seq 1066210153, win 5840, options [mss 1366,sackOK,TS val 2806572 ecr 0,nop,wscale 6], length 0
^C
28 packets captured
28 packets received by filter
0 packets dropped by kernel
А вот с роутингами беда...
iptables-save vpn сервера:
root@debserver:~# iptables-save
# Generated by iptables-save v1.4.4 on Wed Jul 14 13:48:24 2010
*nat
:PREROUTING ACCEPT [726:47061]
:POSTROUTING ACCEPT [2309:211472]
:OUTPUT ACCEPT [1730:176440]
COMMIT
# Completed on Wed Jul 14 13:48:24 2010
# Generated by iptables-save v1.4.4 on Wed Jul 14 13:48:24 2010
*mangle
:PREROUTING ACCEPT [10707:1282460]
:INPUT ACCEPT [8720:1115260]
:FORWARD ACCEPT [1987:167200]
:OUTPUT ACCEPT [8766:1071888]
:POSTROUTING ACCEPT [10828:1245782]
COMMIT
# Completed on Wed Jul 14 13:48:24 2010
# Generated by iptables-save v1.4.4 on Wed Jul 14 13:48:24 2010
*filter
:INPUT ACCEPT [8720:1115260]
:FORWARD ACCEPT [1818:156497]
:OUTPUT ACCEPT [8766:1071888]
-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
COMMIT
# Completed on Wed Jul 14 13:48:24 2010
С NAT-ом экспериментировал по всякому, результатов нет.
