-A FORWARD -p udp -m udp --dport 9987 -d 192.168.168.2 -j ACCEPT
-A FORWARD -p udp -m udp --sport 9987 -j ACCEPT

-A PREROUTING -d PUBLIC_IP_A/32 -p udp -m udp --dport 9987 -j DNAT --to-destination 192.168.168.2:9987
-A POSTROUTING -s 192.168.168.0/30 ! -o gre+ -j SNAT --to-source PUBLIC_IP_A

ip rule add fwmark 65 table NOVPN
ip route add default via 172.31.1.1 dev eth0 table NOVPN
iptables -t mangle -A OUTPUT -p tcp --sport 22 -j MARK --set-mark 65

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.31.1.1      0.0.0.0         UG    0      0        0 eth0
172.31.1.1      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
192.168.168.0   0.0.0.0         255.255.255.252 U     0      0        0 gre1

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         11.28.146.1     128.0.0.0       UG    0      0        0 tun0
0.0.0.0         172.31.1.1      0.0.0.0         UG    0      0        0 eth0
11.28.146.0     0.0.0.0         255.255.255.0   U     0      0        0 tun0
128.0.0.0       11.28.146.1     128.0.0.0       UG    0      0        0 tun0
172.31.1.1      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
192.168.168.0   0.0.0.0         255.255.255.252 U     0      0        0 gre1
VPN_IP          172.31.1.1      255.255.255.255 UGH   0      0        0 eth0