Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2596

Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't)

Show all headers | View raw

Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:

> Iptables and routing apply to layer 3 (network).
> Your tunnel interface (tap0) is a layer 2 (data link) device.
> 
> If you're tunneling at data link layer, the firewall does
> not do anything at it.
> 
> I'd start by changing the VPN to use tun0 instead.

Hi,

Thanks for the reply, but I don't think it's the case here. Why:

1. For now I'm dealing only with two tables - "main" and "wan".
I'll use "vpn" table when I'll be able to correctly mark packets
to pass through "wan" table instead of "main" table. For now we
can assume that VPN doesn't exist, it will come into play later.

2. tap0 is on layer 2, but it's only an interface, I want to
redirect layer 3 traffic to this tunnel in the same way it
would be done with other, physical datalink interfaces (e.g.
Ethernet), basing on their assigned IP addresses.

Once again thanks for the reply.

Cheers.

AW

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 13:45 +0000
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-12-03 16:46 +0200
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 18:07 +0000
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-03 23:58 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-04 00:13 +0100
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-07 12:36 +0000
      Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:14 +0100
        Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:21 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) logsnaath@gmail.com - 2014-08-03 13:06 -0700
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-03 23:22 +0200

csiph-web