Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #2626
| From | gof@somewhere.invalid (Adam Wysocki) |
|---|---|
| Newsgroups | comp.os.linux.networking |
| Subject | Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) |
| Date | 2013-12-07 12:36 +0000 |
| Organization | ATMAN - ATM S.A. |
| Message-ID | <gof.1386419753.23694@somewhere.invalid> (permalink) |
| References | <gof.1386078295.6555@somewhere.invalid> <l7lohu$2ja0$1@saria.nerim.net> |
Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote: Hi, Sorry for the late reply, but I finally found some time to fiddle with it... >> And now the tricky part. I can't make iptables mark packets (or can't >> make iproute2 honor fwmark). I've tried different combinations of: > > Which combinations exactly ? You cannot have all those rules together, > it just does not make sense. Ok, I left only these rules that you said. > I'd start with just the above two rules in PREROUTING and OUTPUT, append > a couple of LOG rules to print the packet mark in the kernel log and see > what happens. It seems that marking is done properly, but iproute2 does not direct matched packets to proper tables. iptables -t mangle -A PREROUTING -j MARK --set-mark 2 iptables -t mangle -A PREROUTING -j LOG --log-prefix "prerouting " iptables -t mangle -A OUTPUT -j MARK --set-mark 2 iptables -t mangle -A OUTPUT -j LOG --log-prefix "output " It gave log lines with MARK=0x02: Dec 7 13:27:32 somewhere kernel: [71053.449380] output IN= OUT=eth1 SRC=192.168.1.180 DST=89.72.158.60 LEN=107 TOS=0x00 PREC=0x00 TTL=64 ID=3020 DF PROTO=TCP SPT=43104 DPT=443 WINDOW=28723 RES=0x00 ACK PSH URGP=0 MARK=0x2 Dec 7 13:27:35 somewhere kernel: [71056.520793] prerouting IN=eth1 OUT= MAC=00:50:04:30:e1:90:74:ea:3a:bd:5d:10:08:00 SRC=89.72.158.60 DST=192.168.1.180 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=59395 DF PROTO=TCP SPT=443 DPT=44304 WINDOW=12600 RES=0x00 ACK URGP=0 MARK=0x2 Dec 7 13:27:38 somewhere kernel: [71059.616705] output IN= OUT=eth0 SRC=192.168.0.1 DST=192.168.0.3 LEN=116 TOS=0x10 PREC=0x00 TTL=64 ID=14433 DF PROTO=TCP SPT=22 DPT=33868 WINDOW=330 RES=0x00 ACK PSH URGP=0 MARK=0x2 Dec 7 13:27:38 somewhere kernel: [71059.617382] prerouting IN=eth0 OUT= MAC=00:0a:5e:60:ce:b0:00:19:7e:19:1e:10:08:00 SRC=192.168.0.3 DST=192.168.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=58487 DF PROTO=TCP SPT=33868 DPT=22 WINDOW=1001 RES=0x00 ACK URGP=0 MARK=0x2 >> And nothing. All commands succeeed, > > Did you check the actual results by printing the routing tables, routing > rules and iptables ruleset ? Yes: [gof@raid ~]$ ip r s 172.24.25.0/24 dev tap0 scope link 192.168.0.0/24 dev eth0 scope link 192.168.1.0/24 dev eth1 scope link [gof@raid ~]$ ip r s t vpn default via 172.24.25.2 dev tap0 172.24.25.0/24 dev tap0 scope link 192.168.0.0/24 dev eth0 scope link 192.168.1.0/24 dev eth1 scope link [gof@raid ~]$ ip r s t wan default via 192.168.1.1 dev eth1 172.24.25.0/24 dev tap0 scope link 192.168.0.0/24 dev eth0 scope link 192.168.1.0/24 dev eth1 scope link [gof@raid ~]$ ip ru s 0: from all lookup local 32764: from all fwmark 0x3 lookup vpn 32765: from all fwmark 0x2 lookup wan 32766: from all lookup main 32767: from all lookup default [gof@raid ~]$ sudo iptables -t mangle -L -n Chain PREROUTING (policy ACCEPT) target prot opt source destination MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x2 LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `prerouting ' Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK set 0x2 LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `output ' Chain POSTROUTING (policy ACCEPT) target prot opt source destination >> but traffic still gets through the main table. > > How do you know ? Main table doesn't have default route, so: [gof@raid ~]$ ping 1.2.3.4 connect: Network is unreachable [gof@raid ~]$ telnet 1.2.3.4 1234 Trying 1.2.3.4... telnet: Unable to connect to remote host: Network is unreachable AW
Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 13:45 +0000
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-12-03 16:46 +0200
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 18:07 +0000
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-03 23:58 +0100
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-04 00:13 +0100
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-07 12:36 +0000
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:14 +0100
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:21 +0100
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) logsnaath@gmail.com - 2014-08-03 13:06 -0700
Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-03 23:22 +0200
csiph-web