Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2600

Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't)

Show all headers | View raw

Adam Wysocki a écrit :
> 
> And now the tricky part. I can't make iptables mark packets (or can't 
> make iproute2 honor fwmark). I've tried different combinations of:

Which combinations exactly ? You cannot have all those rules together,
it just does not make sense.

> #v+
> iptables -t mangle -A PREROUTING -j MARK --set-mark 2

Fine, that should mark all incoming packets.

> iptables -t mangle -A POSTROUTING -j MARK --set-mark 2

Useless : POSTROUTING is after the routing decision, so it will have no
effet.

> iptables -t mangle -A OUTPUT -j MARK --set-mark 2

Fine, that should mark all locally generated packets.
I'd start with just the above two rules in PREROUTING and OUTPUT, append
a couple of LOG rules to print the packet mark in the kernel log and see
what happens.

> iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
> iptables -t mangle -A POSTROUTING -j CONNMARK --restore-mark
> iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
> iptables -t mangle -A PREROUTING -m connmark --mark 2 -j CONNMARK --restore-mark
> iptables -t mangle -A POSTROUTING -m connmark --mark 2 -j CONNMARK --restore-mark
> iptables -t mangle -A OUTPUT -m connmark --mark 2 -j CONNMARK --restore-mark
> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 2
> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j CONNMARK --set-mark 2
> iptables -t mangle -A PREROUTING -m connmark --mark 2 -j CONNMARK --restore-mark
> iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark

There are a lot of rules with --restore-mark (copy the connection mark
to the packet mark), but only one rule setting the connection mark.

> And nothing. All commands succeeed,

Did you check the actual results by printing the routing tables, routing
rules and iptables ruleset ?

> but traffic still gets through the main table.

How do you know ?

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 13:45 +0000
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2013-12-03 16:46 +0200
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-03 18:07 +0000
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-03 23:58 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-04 00:13 +0100
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) gof@somewhere.invalid (Adam Wysocki) - 2013-12-07 12:36 +0000
      Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:14 +0100
        Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-12-07 16:21 +0100
  Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) logsnaath@gmail.com - 2014-08-03 13:06 -0700
    Re: iproute2 fwmark doesn't work (or iptables --set-mark doesn't) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-03 23:22 +0200

csiph-web