Re: Marking and Mangling for QoS

[Unknown <unknown@unknown.invalid>]

[-- Attachment #1: Type: text/plain, Size: 2073 bytes --]

On Mon, 2002-11-25 at 12:24, COUSIN Marc wrote:
> Hi,
> I'm having trouve using mangling on NATed packets:
> 
> Here's what we're trying to do:
> We're trying to build a system to test the behaviour of our web applications
> with slow links. For that, we decided to use the Linux QoS, and SNAT+DNAT to
> redirect the packets from the linux system to the webserver. The idea behind
> this is that someone contacting the linux on the 8081 port will be
> transparently redirected to the 8080 of the real web server, simulating a
> 56k modem. on the 8082 port, it could be a 128 link, etc ...
> 
> The system is a Redhat 7.3
> 
> To create this, I used:
> - DNAT and SNAT rules to redirect the packets from my port to the web
> server, and SNAT the packet (so that it is returned to me and i can shape it
> too) [these are OK]
> - a QoS script (simple, using fwmarks) [ok too]
> - And I wanted to mangle the packets to put the marks on the NATed pakets
> [here comes the trouble]
> I'll continue on the above example :
> 
> # For the NAT
> iptables -t nat -A PREROUTING -p tcp --destination-port 8081:8090 -j DNAT
> --to-destination 89.131.0.7:8080
> iptables -t nat -A POSTROUTING -p tcp --destination 89.131.0.7 -j SNAT
> --to-source 89.131.0.58
> # For the marks
> iptables -A PREROUTING -t mangle -p tcp --destination-port 8081 -j MARK
> --set-mark 10 
> iptables -A POSTROUTING -t mangle -p tcp --source-port 8081 -j MARK
> --set-mark 11 # Trying to match the return NATed packet
> 
> 
> The --set-mark 10 works (no surprise, very simple rule in fact)
> the --set-mark 11 doesn't match. It may be normal, as I'm trying to match a
> return packet on a NAT connexion. How am I supposed to match the return
> packet in such a situation ?
> 
The return packets (AFAIK) are part of the original PREROUTING rule, and
therefore will not be matched by the POSTROUTING rule which will be
matched by traffic originating from your webserver (and not RELATED to
another connection).

Hope this helps ...

Ray
> Thanks fof helping
-- 

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]