From: Patrick McHardy <kaber@trash.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Iproute2 src mangling problems
Date: Tue, 22 Nov 2005 07:22:09 +0000 [thread overview]
Message-ID: <4382C721.8060904@trash.net> (raw)
In-Reply-To: <20051121160130.ny8ol2nkwrkkso8o@qbranch.gavintech.com>
Chris Kloosterman wrote:
> - We have two IP addresses assigned to this machine using aliases:
>
> [root@tequesta ~]# ip addr show
> 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
> ...
> inet xxx.yyy.zzz.39/24 brd xxx.yyy.zzz.255 scope global eth0
> inet xxx.yyy.zzz.16/24 brd xxx.yyy.zzz.255 scope global secondary eth0:0
> ...
>
> - We're marking packets that go through iptables with mark 0xf1:
>
> /sbin/iptables -I OUTPUT -t mangle -m owner --uid-owner (uid) -j MARK
> --set-mark 0xf1
>
> - With iproute2, we're setting packets marked with 0xf1 to go to a
> special table (which has already been created in the proper places):
>
> /sbin/ip rule add fwmark 0xf1 lookup kloostec
>
> - The routing table kloostec looks like this:
>
> xxx.yyy.zzz.0/24 dev eth0 proto static src xxx.yyy.zzz.16
> default via xxx.yyy.zzz.254 dev eth0
>
> - The routing table default looks like this:
>
> xxx.yyy.zzz.0/24 dev eth0 scope link src xxx.yyy.zzz.39
> ...
> default via xxx.yyy.zzz.254 dev eth0
>
> =======>
> So, my question is, why are the packets not having their source address
> changed when they are marked 0xf1? If anyone could answer this, it
> would end days of searching and reading documentation and pulling my
> hair out!
What source address does the packet have when it hits your mark rule? :)
No, seriously, this is a common misunderstanding, unfortunately what
you're trying to do is not possible. At the time the source address is
selected there is no packet and as a consequence no netfilter mark, so
marks can't be uses for this. The only way is to use SNAT.
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
prev parent reply other threads:[~2005-11-22 7:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-11-22 0:01 [LARTC] Iproute2 src mangling problems Chris Kloosterman
2005-11-22 7:22 ` Patrick McHardy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4382C721.8060904@trash.net \
--to=kaber@trash.net \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.