Re: policy routing on locally generated packets [summary]

[Patrick McHardy <kaber@trash.net>]

lartc@manchotnetworks.net wrote:

>final conclusion:
>to effectively obtain policy routing on locally generated packets, the
>OUTPUT ROUTING process would need to be hooked into netfilter thereby
>letting packets be marked. OUTPUT ROUTING would then use the mark to
>find a routing table via a routing rule. OUTPUT ROUTING would get the
>route key fields using the "best" destination route within the routing
>table, or use the default routing table if no suitable route was found.
>(Cedric -- this would include the iif key therefore obviating/including
>your patch through ip route commands)
>
>
>iptables --append OUTROUTE --table mangle (expressions) \
>         --jump MARK --set-mark 0x2
>

It is not possible for two reasons:
- before output routing the packet doesn't have a source ip so it
would be weird to pass it through iptables tables.
- the source is chosen before the ip header is prepended, this
makes it impossible to pass it to iptables first.

Why can't you use NAT ?

Best regards,
Patrick