Router (and masquerade) only from specific IP

I want all traffic coming from 192.168.2.10 on interface eth0 to be masqueraded and forwarded out through interface tun0. I want the response to come back through tun0. I don't want other traffic on interface eth0 to be affected. This is what I have:

# iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
# iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i eth0 -s 192.168.2.10/32 -o tun0 -j ACCEPT
# ip rule add from 192.168.2.10/32 table 100
# ip route add default via 10.8.0.1 table 100

Is this configuration correct? It appears to be working but traffic looks very strange in iftop . It looks like the outgoing traffic is going through tun0 but the response is coming on eth0, although I may be reading it wrong or it may be caused by misconfiguration on the other end.

Recent Questions...