mark value as routing key

mark value as routing key

[Marco Berizzi]

Hi.

I have a problem with iptables mark target.
I'm using iptables to mark packet in this manner:

iptables -t mangle -I OUTPUT --protocol tcp --dport 80 -j MARK --set-mark 1

This linux box has two different ip addresses on
two different subnet on the same ethernet NIC:

eth0: 1.1.1.254/24
eth0:adslA: 10.10.10.6/29

This is my ip rule sh output:

0: from all lookup local
400: from all fwmark 0x1 lookup adsl
450: from all lookup hdsl
32766: from all lookup main
32767: from all lookup default

Here is ip route sh table adsl:
default via 10.10.10.1 dev eth0 metric 1
and this is ip route sh table hdsl:
default via 1.1.1.1 dev eth0 metric 1

main table doesn't have any default route.

Locally generated packet with destination port 80
are going through the adsl table but the packet
source ip is 1.1.1.254. Why?

Kernel is vanilla 2.6.14-rc4

mark value as routing key

[Marco Berizzi]

Hi.

I have a problem with iptables mark target.
I'm using iptables to mark packet in this manner:

iptables -t mangle -I OUTPUT --protocol tcp --dport 80 -j MARK --set-mark 1

This linux box has two different ip addresses on
two different subnet on the same ethernet NIC:

eth0: 1.1.1.254/24
eth0:adslA: 10.10.10.6/29

This is my ip rule sh output:

0: from all lookup local
400: from all fwmark 0x1 lookup adsl
450: from all lookup hdsl
32766: from all lookup main
32767: from all lookup default

Here is ip route sh table adsl:
default via 10.10.10.1 dev eth0 metric 1
and this is ip route sh table hdsl:
default via 1.1.1.1 dev eth0 metric 1

main table doesn't have any default route.

Locally generated packet with destination port 80
are going through the adsl table but the packet
source ip is 1.1.1.254. Why source ip packet is
1.1.1.254? Should't it be 10.10.10.6?

Kernel is vanilla 2.6.14-rc4

TIA

Re: mark value as routing key

[Martijn Lievaart]

Marco Berizzi zei:

> Here is ip route sh table adsl:
> default via 10.10.10.1 dev eth0 metric 1
> and this is ip route sh table hdsl:
> default via 1.1.1.1 dev eth0 metric 1
>
> main table doesn't have any default route.
>
> Locally generated packet with destination port 80
> are going through the adsl table but the packet
> source ip is 1.1.1.254. Why source ip packet is
> 1.1.1.254? Should't it be 10.10.10.6?

I think you are missing the 'src' option in your routes.

default via 10.10.10.1 dev eth0 metric 1 src 10.10.10.6

HTH,
M4

P.S. This is better suited for the user  list, not the developers list.

Re: mark value as routing key

[Henrik Nordstrom]

On Thu, 20 Oct 2005, Marco Berizzi wrote:

> Locally generated packet with destination port 80
> are going through the adsl table but the packet
> source ip is 1.1.1.254. Why source ip packet is
> 1.1.1.254? Should't it be 10.10.10.6?

Because source address assignment takes place very early, before there 
even is a packet to be seen by iptables, by using a very special routing 
lookup.

To get around this you can SNAT the traffic before it leaves the box, or 
configure the application to specifically use the correct source address.


Regards
Henrik

Re: mark value as routing key

[David Coulson]

Marco Berizzi wrote:

> Locally generated packet with destination port 80
> are going through the adsl table but the packet
> source ip is 1.1.1.254. Why source ip packet is
> 1.1.1.254? Should't it be 10.10.10.6?

No - You will have to create a NAT rule to NAT anything marked with 0x1
onto 10.10.10.6.

David

-- 
David J. Coulson
email: david@davidcoulson.net
web: http://www.davidcoulson.net/

Re: mark value as routing key

[Patrick McHardy]

Marco Berizzi wrote:
> Hi.
> 
> I have a problem with iptables mark target.
> I'm using iptables to mark packet in this manner:
> 
> iptables -t mangle -I OUTPUT --protocol tcp --dport 80 -j MARK --set-mark 1
> 
> This linux box has two different ip addresses on
> two different subnet on the same ethernet NIC:
> 
> eth0: 1.1.1.254/24
> eth0:adslA: 10.10.10.6/29
> 
> This is my ip rule sh output:
> 
> 0: from all lookup local
> 400: from all fwmark 0x1 lookup adsl
> 450: from all lookup hdsl
> 32766: from all lookup main
> 32767: from all lookup default
> 
> Here is ip route sh table adsl:
> default via 10.10.10.1 dev eth0 metric 1
> and this is ip route sh table hdsl:
> default via 1.1.1.1 dev eth0 metric 1
> 
> main table doesn't have any default route.
> 
> Locally generated packet with destination port 80
> are going through the adsl table but the packet
> source ip is 1.1.1.254. Why source ip packet is
> 1.1.1.254? Should't it be 10.10.10.6?

The mark value can't be used for source address selection
because at the time source address selection is performed
there is no packet yet and thus no mark value.