Groups > comp.os.linux.networking > #2596

Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't)

Path	csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.pionier.net.pl!plix.pl!newsfeed2.plix.pl!wsisiz.edu.pl!newsfeed2.atman.pl!newsfeed.atman.pl!.POSTED!not-for-mail
From	gof@somewhere.invalid (Adam Wysocki)
Newsgroups	comp.os.linux.networking
Subject	Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't)
Date	Tue, 3 Dec 2013 18:07:01 +0000 (UTC)
Organization	ATMAN - ATM S.A.
Lines	29
Message-ID	<gof.1386094009.7563@somewhere.invalid> (permalink)
References	<gof.1386078295.6555@somewhere.invalid> <l7kqrv$gss$1@dont-email.me>
NNTP-Posting-Host	89-72-158-67.dynamic.chello.pl
X-Trace	node2.news.atman.pl 1386094021 7505 89.72.158.67 (3 Dec 2013 18:07:01 GMT)
X-Complaints-To	usenet@atman.pl
NNTP-Posting-Date	Tue, 3 Dec 2013 18:07:01 +0000 (UTC)
User-Agent	tin/2.1.0-20111224 ("Bridgend") (UNIX) (Linux/3.11.4-raid (i686))
Xref	csiph.com comp.os.linux.networking:2596

Show key headers only | View raw

Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:

> Iptables and routing apply to layer 3 (network).
> Your tunnel interface (tap0) is a layer 2 (data link) device.
> 
> If you're tunneling at data link layer, the firewall does
> not do anything at it.
> 
> I'd start by changing the VPN to use tun0 instead.

Hi,

Thanks for the reply, but I don't think it's the case here. Why:

1. For now I'm dealing only with two tables - "main" and "wan".
I'll use "vpn" table when I'll be able to correctly mark packets
to pass through "wan" table instead of "main" table. For now we
can assume that VPN doesn't exist, it will come into play later.

2. tap0 is on layer 2, but it's only an interface, I want to
redirect layer 3 traffic to this tunnel in the same way it
would be done with other, physical datalink interfaces (e.g.
Ethernet), basing on their assigned IP addresses.

Once again thanks for the reply.

Cheers.

AW

Thread

iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 13:45 +0000
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-12-03 16:46 +0200
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 18:07 +0000
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-03 23:58 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-04 00:13 +0100
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-07 12:36 +0000
      Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:14 +0100
        Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:21 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) logsnaath@gmail.com - 2014-08-03 13:06 -0700
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-03 23:22 +0200

csiph-web