Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2592

iproute2 fwmark doesn't work (or iptables --set-mark doesn't)

Show key headers only | View raw

Hi,

I just subscribed this group. Hello everyone!

I have a problem with setting up routing. In short, I want to mark certain 
packets with iptables and then catch these marks with iproute2. However 
Linux seems to ignore these marks.

I have a 3.11.4 kernel with CONFIG_IP_ADVANCED_ROUTER and CONFIG_IP_MULTIPLE_TABLES 
set. Here's my setup:

- eth0: LAN
  - IP 192.168.0.1, netmask /24
  - It connects to the LAN

- eth1: WAN
  - IP 192.168.1.180, netmask /24, gateway 192.168.1.1
  - It connects to the Internet

- tap0: VPN (created with OpenVPN)
  - Local IP 172.24.25.4, remote IP (and gateway) 172.24.25.2, netmask /24

I want to pass certain traffic through 192.168.1.1 (eth1) and certain through 
172.24.25.2 (tap0) - local traffic as well as routed traffic. Rules will be 
somewhat complicated (for locally-generated traffic and routed traffic), now 
just let's assume that I want to mark all packets to go through 192.168.1.1.

I have added two new routing tables to /etc/iproute2/rt_tables:

#v+
2 vpn
3 wan
#v-

I've created two of them, so the main table will not have a default gateway. 
This way I can avoid errors - if I make a mistake and traffic goes through 
the main table, it won't get out.

Tables are then populated:

#v+
ip route flush table main
ip route add 192.168.0.0/24 dev eth0 table main
ip route add 192.168.1.0/24 dev eth1 table main
ip route add 172.24.25.0/24 dev tap0 table main

ip route flush table wan
ip route add 192.168.0.0/24 dev eth0 table wan
ip route add 192.168.1.0/24 dev eth1 table wan
ip route add 172.24.25.0/24 dev tap0 table wan
ip route add default via 192.168.1.1 dev eth1 table wan

ip route flush table vpn
ip route add 192.168.0.0/24 dev eth0 table vpn
ip route add 192.168.1.0/24 dev eth1 table vpn
ip route add 172.24.25.0/24 dev tap0 table vpn
ip route add default via 172.24.25.2 dev tap0 table vpn
#v-

And now rules. I want packets marked with 2 going through WAN and packets 
marked with 3 going through VPN.

#v+
ip rule flush

# restore default rules (deleted by flush)
ip rule add from all lookup main prio 32766
ip rule add from all lookup default prio 32767

ip rule add fwmark 2 table wan
ip rule add fwmark 3 table vpn
#v-

Now the cache is reloaded...

#v+
ip route flush table cache
#v-

And iptables flushed:

#v+
iptables -t filter -F
iptables -t nat -F
iptables -t mangle -F
#v-

And now the tricky part. I can't make iptables mark packets (or can't 
make iproute2 honor fwmark). I've tried different combinations of:

#v+
iptables -t mangle -A PREROUTING -j MARK --set-mark 2
iptables -t mangle -A POSTROUTING -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
iptables -t mangle -A POSTROUTING -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m connmark --mark 2 -j CONNMARK --restore-mark
iptables -t mangle -A POSTROUTING -m connmark --mark 2 -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -m connmark --mark 2 -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j CONNMARK --set-mark 2
iptables -t mangle -A PREROUTING -m connmark --mark 2 -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
#v-

And nothing. All commands succeeed, but traffic still gets through the 
main table. Regarding to this:

http://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.netfilter.html

it should work. What am I missing?

Kernel doesn't have CONFIG_IP_ROUTE_FWMARK (it's completely absent), but 
I've read that in new kernels it is enabled by default and not found in 
config.

Thanks for your time.

Cheers.

AW

Back to comp.os.linux.networking | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 13:45 +0000
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-12-03 16:46 +0200
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 18:07 +0000
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-03 23:58 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-04 00:13 +0100
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-07 12:36 +0000
      Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:14 +0100
        Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:21 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) logsnaath@gmail.com - 2014-08-03 13:06 -0700
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-03 23:22 +0200

csiph-web