~ # ifconfig br0 Link encap:Ethernet HWaddr 00:0F:66:3E:1B:F0 inet addr:192.168.5.1 Bcast:192.168.5.255 Mask:255.255.255.0 UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:756902 errors:0 dropped:0 overruns:0 frame:0 TX packets:498918 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:799374100 (762.3 MiB) TX bytes:43628716 (41.6 MiB) br0:0 Link encap:Ethernet HWaddr 00:0F:66:3E:1B:F0 inet addr:169.254.255.1 Bcast:169.254.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST MTU:1500 Metric:1 eth0 Link encap:Ethernet HWaddr 00:0F:66:3E:1B:F0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1256564 errors:0 dropped:0 overruns:0 frame:0 TX packets:1233839 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:864909988 (824.8 MiB) TX bytes:858306459 (818.5 MiB) Interrupt:5 eth1 Link encap:Ethernet HWaddr 00:0F:66:3E:1B:F2 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:405 errors:0 dropped:0 overruns:0 frame:37336 TX packets:5172 errors:367 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:34494 (33.6 KiB) TX bytes:701804 (685.3 KiB) Interrupt:4 Base address:0x1000 imq0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 UP RUNNING NOARP MTU:1500 Metric:1 RX packets:499300 errors:0 dropped:0 overruns:0 frame:0 TX packets:499300 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 RX bytes:35860633 (34.1 MiB) TX bytes:35860633 (34.1 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1 RX packets:204 errors:0 dropped:0 overruns:0 frame:0 TX packets:204 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:18868 (18.4 KiB) TX bytes:18868 (18.4 KiB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:175 errors:0 dropped:0 overruns:0 frame:0 TX packets:173 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:33081 (32.3 KiB) TX bytes:33676 (32.8 KiB) vlan0 Link encap:Ethernet HWaddr 00:0F:66:3E:1B:F0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:756522 errors:0 dropped:0 overruns:0 frame:0 TX packets:502206 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:802385352 (765.2 MiB) TX bytes:45519554 (43.4 MiB) vlan1 Link encap:Ethernet HWaddr 00:0F:66:3E:1B:F1 inet addr:192.168.254.1 Bcast:192.168.254.255 Mask:255.255.255.0 UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:500042 errors:0 dropped:0 overruns:0 frame:0 TX packets:731659 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:39919923 (38.0 MiB) TX bytes:806944617 (769.5 MiB) ~ # ip route show 10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6 <--- the ip assigned to my WRT 10.8.0.1 via 10.8.0.5 dev tun0 <--- the ip of my vpn server 192.168.5.0/24 dev br0 proto kernel scope link src 192.168.5.1 <--- my lan network 200.76.225.0/24 via 10.8.0.5 dev tun0 <--- pushed network i sent to debug 192.168.254.0/24 dev vlan1 proto kernel scope link src 192.168.254.1 <--- WAN network of my router 169.254.0.0/16 dev br0 proto kernel scope link src 169.254.255.1 127.0.0.0/8 dev lo scope link default via 192.168.254.254 dev vlan1 This is what ive tried so far with no success ip rule add lookup main prio 32766 ip rule add lookup default prio 32767 ip rule add from 10.8.0.6 table 100 prio 100 ip rule add fwmark 0x100 table 100 prio 101 ip route flush table 100 for TABLE in 100 do ip route | grep link | while read ROUTE do ip route add table $TABLE to $ROUTE done done ip route add table 100 default via 10.8.0.5 iptables -t mangle -A PREROUTING -i tun0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100 iptables -t mangle -A POSTROUTING -o tun0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100 iptables -A POSTROUTING -t nat -m mark --mark 0x100 -j SNAT --to-source 10.8.0.6 iptables -t mangle -A PREROUTING -i br0 -m multiport -p tcp --dport 222,22 -j MARK --set-mark 0x100