Re: ROUTE woes ?

Re: ROUTE woes ?

[/dev/rob0]

On Tuesday 2005-August-23 15:20, Ruben Cardenal wrote:
> http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-ROUTE
>
>   In order to be able to use it, you must download also iptables and
> patch-o-matic and compile all the needed stuff. The order is
>
>   a) Apply patch-o-matic against the iptables source
>   b) Compile and install iptables
>   c) Recompile your kernel to generate the ipt_ROUTE module (the
> prior iptables configuration will add it to your kernel tree).

If all netfilter drivers were built as modules, is an entire compile / 
reboot necessary? Can you just get away with a "make modules" (and 
"make modules_install") if the POM drivers are the only thing you're 
changing?

I'd like to play with POM sometime, but I don't reboot if I can avoid 
it. :)
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: ROUTE woes ?

[Ruben Cardenal]

> >   a) Apply patch-o-matic against the iptables source
> >   b) Compile and install iptables
> >   c) Recompile your kernel to generate the ipt_ROUTE module (the
> > prior iptables configuration will add it to your kernel tree).
> 
> If all netfilter drivers were built as modules, is an entire compile /
> reboot necessary? Can you just get away with a "make modules" (and
> "make modules_install") if the POM drivers are the only thing you're
> changing?

  Where did I say reboot, dude? :) When you say "recompile your kernel" you
know you are refering to "make the needed changes, issue the needed actions"
:) If we needed a reboot for everything, we would be called windows :P

  Regards,

- Ruben

Re: ROUTE woes ?

[Brent Clark]

Ruben Cardenal wrote:
> 
> http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-ROUTE
> 
>   Btw: It works.
> 

Hi Ruben / list

a big thanks to all for replying to my email.

I know and see ROUTE is avail with POM, but I heard from two different people that ROUTE is part of the 2.6 series kernel.

Problem is, either they are both wrong, as I cant find ROUTE in my kernel.

And the other thing is, i got POM from

ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20050822.tar.bz2

obviously with me running debian I needed the iptables source.

I downloaded that as well tar jxvf and then ran run runme in the patchomatic directory and not once was I offered ROUTE.

So now im at a complete loss.

If anyone could share of any tip or tricks, I would be most greatful.

Kind Regards, and thanks in advance.

Brent Clark

RE: ROUTE woes ?

[Jan Engelhardt]

>> gate:/usr/src# iptables -t mangle -A FORWARD -p tcp --dport 80 -j ROUTE --
>> oif eth2
>
>  It must be used on the POSTROUTING chain of the mangle table.

Hm this sounds somewhat illogical: to route when "routing has already been 
done" (latin: postrouting). It also requires to have something like:

	ipt -t mangle -A FORWARD -i eth1 -j MARK --set-mark 7
	ipt -t mangle -A POSTROUTING -m mark --mark 7 -j ROUTE

instead of just

	ipt -t mangle -A FORWARD -i eth1 -j ROUTE


Jan Engelhardt
-- 

RE: ROUTE woes ?

[Ruben Cardenal]

> >  It must be used on the POSTROUTING chain of the mangle table.
> 
> Hm this sounds somewhat illogical: to route when "routing has already been
> done" (latin: postrouting).

http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-ROUTE

  Btw: It works.

  Regards,

- Ruben

Re: ROUTE woes ?

[/dev/rob0]

On Tuesday 2005-August-23 15:34, Ruben Cardenal wrote:
> > If all netfilter drivers were built as modules, is an entire
> > compile / reboot necessary? Can you just get away with a "make
> > modules" (and "make modules_install") if the POM drivers are the
> > only thing you're changing?
>
>   Where did I say reboot, dude? :) When you say "recompile your
> kernel" you know you are refering to "make the needed changes, issue
> the needed actions"

Sometimes not, like if a new module requires changing something in a 
driver that was built in. What I was really asking was if POM needs any 
hooks that might not exist in the kernel, and I guess you have answered 
that.

> :) If we needed a reboot for everything, we would be called windows
> : :P

A surprising number of people think they want monolithic kernels which 
*do* rather emulate Windows in their inflexibility. Modularity is one 
of my favourite rant subjects. :)

Thanks for the reply.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: ROUTE woes ?

[Brent Clark]

Ruben Cardenal wrote:
> Hi,
> 
>>gate:/usr/src# iptables -t mangle -A FORWARD -p tcp --dport 80 -j ROUTE --
>>oif eth2
> 
>   It must be used on the POSTROUTING chain of the mangle table.

Hi Ruben

Thanks for replying

You 100% correct, thanks for setting me straight, but i still struggling, since I dont have the target ROUTE in my kernel

gate:~# iptables -t mangle -A POSTROUTING -p tcp --dport 80 -j ROUTE --oif eth2
iptables: No chain/target/match by that name
gate:~#

Ive been looking at the various path o matics, and I cant find the patch my kernel.

Thanks anyway

Kind Regards
Brent Clark

RE: ROUTE woes ?

[Ruben Cardenal]

Hi,

> You 100% correct, thanks for setting me straight, but i still struggling,
> since I dont have the target ROUTE in my kernel
> 
> gate:~# iptables -t mangle -A POSTROUTING -p tcp --dport 80 -j ROUTE --oif
> eth2
> iptables: No chain/target/match by that name
> gate:~#
> 
> Ive been looking at the various path o matics, and I cant find the patch
> my kernel.

  This target belongs to the extra respository of patch-o-matic:

  http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-ROUTE

  In order to be able to use it, you must download also iptables and
patch-o-matic and compile all the needed stuff. The order is

  a) Apply patch-o-matic against the iptables source
  b) Compile and install iptables
  c) Recompile your kernel to generate the ipt_ROUTE module (the prior
iptables configuration will add it to your kernel tree).

 Regards,

- Ruben

ROUTE woes ?

[Brent Clark]

Hi list

I tried at suggestion of:

gate:/usr/src# iptables -t mangle -A FORWARD -p tcp --dport 80 -j ROUTE --oif eth2

But all i get is:
iptables: No chain/target/match by that name

During this time I have been googling and trying to find out why this is failing.

The reason I cant undertand is that I am running debian sarge so therefore the iptables version is v1.3.1

I looked for the module ROUTE and it defiantly if there.

ROUTE target v1.11 options:
     --oif       ifname          Route packet through `ifname' network interface
     --iif       ifname          Change packet's incoming interface to `ifname'
     --gw        ip              Route packet via this gateway `ip'
     --continue                  Route packet and continue traversing the
                                 rules. Not valid with --iif or --tee.
     --tee                       Duplicate packet, route the duplicate,
                                 continue traversing with original packet.
                                 Not valid with --iif or --continue.

So on looking at the kernel src

I worked out that I had not added or  complied in multipath, I have now

gate:/usr/src/linux# cat .config | grep ROUTE
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_ROUTE_FWMARK=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y

and too this day I still am getting

gate:/usr/src/linux# iptables -t mangle -A FORWARD -p tcp --dport 80 -j ROUTE --oif eth2
iptables: No chain/target/match by that name
gate:/usr/src/linux#

If anyone can help in anyway, I would be most greatful.

Kind Regards, and again thanks in advance.

Brent Clark

RE: ROUTE woes ?

[Ruben Cardenal]

Hi,

> gate:/usr/src# iptables -t mangle -A FORWARD -p tcp --dport 80 -j ROUTE --
> oif eth2

  It must be used on the POSTROUTING chain of the mangle table.

  Regards,

- Ruben