Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.pionier.net.pl!plix.pl!newsfeed2.plix.pl!wsisiz.edu.pl!newsfeed2.atman.pl!newsfeed.atman.pl!.POSTED!not-for-mail
From: gof@somewhere.invalid (Adam Wysocki)
Newsgroups: comp.os.linux.networking
Subject: Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't)
Date: Tue, 3 Dec 2013 18:07:01 +0000 (UTC)
Organization: ATMAN - ATM S.A.
Lines: 29
Message-ID: <gof.1386094009.7563@somewhere.invalid>
References: <gof.1386078295.6555@somewhere.invalid> <l7kqrv$gss$1@dont-email.me>
NNTP-Posting-Host: 89-72-158-67.dynamic.chello.pl
X-Trace: node2.news.atman.pl 1386094021 7505 89.72.158.67 (3 Dec 2013 18:07:01 GMT)
X-Complaints-To: usenet@atman.pl
NNTP-Posting-Date: Tue, 3 Dec 2013 18:07:01 +0000 (UTC)
User-Agent: tin/2.1.0-20111224 ("Bridgend") (UNIX) (Linux/3.11.4-raid (i686))
Xref: csiph.com comp.os.linux.networking:2596

Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:

> Iptables and routing apply to layer 3 (network).
> Your tunnel interface (tap0) is a layer 2 (data link) device.
> 
> If you're tunneling at data link layer, the firewall does
> not do anything at it.
> 
> I'd start by changing the VPN to use tun0 instead.

Hi,

Thanks for the reply, but I don't think it's the case here. Why:

1. For now I'm dealing only with two tables - "main" and "wan".
I'll use "vpn" table when I'll be able to correctly mark packets
to pass through "wan" table instead of "main" table. For now we
can assume that VPN doesn't exist, it will come into play later.

2. tap0 is on layer 2, but it's only an interface, I want to
redirect layer 3 traffic to this tunnel in the same way it
would be done with other, physical datalink interfaces (e.g.
Ethernet), basing on their assigned IP addresses.

Once again thanks for the reply.

Cheers.

AW