From: Alexander Samad <alex@samad.com.au>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] mark & owner for local connections
Date: Fri, 15 Oct 2004 21:37:05 +0000 [thread overview]
Message-ID: <20041015213705.GA2682@samad.com.au> (raw)
In-Reply-To: <20041015110541.GB25388@spirit.segfault.net>
[-- Attachment #1: Type: text/plain, Size: 1264 bytes --]
On Fri, Oct 15, 2004 at 11:05:41AM +0000, rm@ingsoc.org wrote:
> Hi,
>
> Host A has two interfaces: eth0, tap0.
> I want that all locally generated traffic from user 1004 goes through
> tap0.
>
> This is what I did:
>
> iptables -A OUTPUT -t mangle -m owner --uid-owner 1004 -j MARK --set-mark 2
> echo 202 bigmac.out >> /etc/iproute2/rt_tables
> ip rule add fwmark 2 table bigmac.out
> ip route add default via 10.0.0.1 dev tap0 table bigmac.out
why not change this to
ip route add default via 10.0.0.1 dev tap0 table bigmac.out src
IPADDRESSofTAP0
> ip route flush cache
>
> This results in these problems:
> - packets from 1004 are send out via tap0 but with source ip of eth0.
> (seen in tcpdump -n -i tap0)
> - iptables packetfilter rules have to bet set on eth0 and not on tap0.
> (if i deny everything on -o eth0 no packet is send out to -o tap0 anymore..)
From my understanding the tap packets go over eth0, you still need to
allow ipip packets (can check with tcpdump)
>
>
> Ideas?
>
>
> Ralf
> rm@ingsoc.org
>
>
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
prev parent reply other threads:[~2004-10-15 21:37 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-10-15 11:05 [LARTC] mark & owner for local connections rm
2004-10-15 21:37 ` Alexander Samad [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20041015213705.GA2682@samad.com.au \
--to=alex@samad.com.au \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.