How to route some sites using IPSET and DNSMASQ to a specific interface?

Question

linux

Help configure the correct routing of some sites to a different interface using ipset and dnsmasq. I have already looked through everything that I found in the manuals, but still something is not working, or rather, the necessary domains do not go through the selected interface.

cat /etc/resolv.conf

spoiler

# Generated by NetworkManager
nameserver 127.0.0.1
nameserver 192.168.0.1

ip a

spoiler

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 02:42:c6:27:b3:b1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.6/24 brd 192.168.2.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fd45:e02f:827e:0:42:c6ff:fe27:b3b1/64 scope global mngtmpaddr dynamic
       valid_lft forever preferred_lft forever
    inet6 fe80::42:c6ff:fe27:b3b1/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 12:42:c6:27:b3:b1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.105/24 brd 192.168.0.255 scope global dynamic wlan0
       valid_lft 6951sec preferred_lft 6951sec
    inet6 fe80::5617:c487:bc95:a666/64 scope link
       valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.114.114.2/24 brd 10.114.114.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::51f9:2967:8ef2:bac7/64 scope link flags 800
       valid_lft forever preferred_lft forever

ip r

spoiler

default via 192.168.0.1 dev wlan0 proto static metric 600
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.105 metric 600
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.6
10.114.114.0/24 dev tun0 proto kernel scope link src 10.114.114.2

cat /etc/dnsmasq.conf

spoiler

listen-address=127.0.0.1
server=/eth0.me/vk.com/127.0.0.1
ipset=/eth0.me/vk.com/vpnlist

Table creation and routing:

ipset create vpnlist hash:ip timeout 3600
ip rule add fwmark 1 table 1
ip route add default dev tun0 table 1
iptables -w -A PREROUTING -t mangle -m set --match-set vpnlist dst,src -j MARK --set-mark 1

host -a eth0.me

spoiler

Trying "eth0.me"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7688
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;eth0.me. IN ANY

;; ANSWER SECTION:
eth0.me. 83491 IN SOA ns1.internex.at. do-not-reply.eth0.me. 2019021705 43200 7200 1209600 86400
eth0.me. 83491 IN NS ns3.internex.at.
eth0.me. 83491 IN NS ns4.internex.at.
eth0.me. 83491 IN NS ns1.internex.at.
eth0.me. 83491 IN NS ns2.internex.at.

Received 157 bytes from 127.0.0.1#53 in 19 ms

I execute wget -qO- eth0.me in response to the output of the provider's ip, not vpn.

Answer 1

Is it all on the same host? Isn't that a router?
Then not PREROUTING but OUTPUT

Answer 2

If there is a VPN (and it is, judging by tun0) - then it's better to take a socks proxy (danted for example) and some extension like foxy proxy. No need to collect IP (which tend to change, especially if the site is on a cloudflare thread).
Alternative - we take quagga or bird, we make statics with the necessary next-hop. No ip rules / sets/ tables are needed for this.
UPD: read more carefully. ipset is created with hash:ip, and for some reason the match is made with src/dst. Why not --match-set vpnlist dst ?