Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2626

Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't)

Show key headers only | View raw

Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote:

Hi,

Sorry for the late reply, but I finally found some time to fiddle with it...

>> And now the tricky part. I can't make iptables mark packets (or can't 
>> make iproute2 honor fwmark). I've tried different combinations of:
> 
> Which combinations exactly ? You cannot have all those rules together,
> it just does not make sense.

Ok, I left only these rules that you said.

> I'd start with just the above two rules in PREROUTING and OUTPUT, append
> a couple of LOG rules to print the packet mark in the kernel log and see
> what happens.

It seems that marking is done properly, but iproute2 does not direct 
matched packets to proper tables.

iptables -t mangle -A PREROUTING -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -j LOG --log-prefix "prerouting "

iptables -t mangle -A OUTPUT -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -j LOG --log-prefix "output "

It gave log lines with MARK=0x02:

Dec  7 13:27:32 somewhere kernel: [71053.449380] output IN= OUT=eth1 SRC=192.168.1.180 DST=89.72.158.60 LEN=107 TOS=0x00 PREC=0x00 TTL=64 ID=3020 DF PROTO=TCP SPT=43104 DPT=443 WINDOW=28723 RES=0x00 ACK PSH URGP=0 MARK=0x2
Dec  7 13:27:35 somewhere kernel: [71056.520793] prerouting IN=eth1 OUT= MAC=00:50:04:30:e1:90:74:ea:3a:bd:5d:10:08:00 SRC=89.72.158.60 DST=192.168.1.180 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=59395 DF PROTO=TCP SPT=443 DPT=44304 WINDOW=12600 RES=0x00 ACK URGP=0 MARK=0x2
Dec  7 13:27:38 somewhere kernel: [71059.616705] output IN= OUT=eth0 SRC=192.168.0.1 DST=192.168.0.3 LEN=116 TOS=0x10 PREC=0x00 TTL=64 ID=14433 DF PROTO=TCP SPT=22 DPT=33868 WINDOW=330 RES=0x00 ACK PSH URGP=0 MARK=0x2
Dec  7 13:27:38 somewhere kernel: [71059.617382] prerouting IN=eth0 OUT= MAC=00:0a:5e:60:ce:b0:00:19:7e:19:1e:10:08:00 SRC=192.168.0.3 DST=192.168.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=58487 DF PROTO=TCP SPT=33868 DPT=22 WINDOW=1001 RES=0x00 ACK URGP=0 MARK=0x2

>> And nothing. All commands succeeed,
> 
> Did you check the actual results by printing the routing tables, routing
> rules and iptables ruleset ?

Yes:

[gof@raid ~]$ ip r s
172.24.25.0/24 dev tap0  scope link
192.168.0.0/24 dev eth0  scope link
192.168.1.0/24 dev eth1  scope link

[gof@raid ~]$ ip r s t vpn
default via 172.24.25.2 dev tap0
172.24.25.0/24 dev tap0  scope link
192.168.0.0/24 dev eth0  scope link
192.168.1.0/24 dev eth1  scope link

[gof@raid ~]$ ip r s t wan
default via 192.168.1.1 dev eth1
172.24.25.0/24 dev tap0  scope link
192.168.0.0/24 dev eth0  scope link
192.168.1.0/24 dev eth1  scope link

[gof@raid ~]$ ip ru s
0:      from all lookup local
32764:  from all fwmark 0x3 lookup vpn
32765:  from all fwmark 0x2 lookup wan
32766:  from all lookup main
32767:  from all lookup default

[gof@raid ~]$ sudo iptables -t mangle -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
MARK       all  --  0.0.0.0/0            0.0.0.0/0           MARK set 0x2
LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `prerouting '

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
MARK       all  --  0.0.0.0/0            0.0.0.0/0           MARK set 0x2
LOG        all  --  0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `output '

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

>> but traffic still gets through the main table.
> 
> How do you know ?

Main table doesn't have default route, so:

[gof@raid ~]$ ping 1.2.3.4
connect: Network is unreachable

[gof@raid ~]$ telnet 1.2.3.4 1234
Trying 1.2.3.4...
telnet: Unable to connect to remote host: Network is unreachable

AW

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 13:45 +0000
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-12-03 16:46 +0200
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 18:07 +0000
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-03 23:58 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-04 00:13 +0100
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-07 12:36 +0000
      Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:14 +0100
        Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:21 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) logsnaath@gmail.com - 2014-08-03 13:06 -0700
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-03 23:22 +0200

csiph-web