Re-routing of output traffic

Re-routing of output traffic

[François Delawarde]

Hello all!

If i'm not wrong, outgoing traffic generated by local processes pass 
through the following:

Local Process ==> OUTPUT [mangle] ==> OUTPUT [nat] ==> Rerouting ==> 
OUTPUT [filter] ==> POSTROUTING ...


I'm interested in using a specific routing table for one of my local 
processes (the entire story is complicated).

I tried the following without success:

iptables -t mangle -A OUTPUT -m owner --gid-owner <group of process> -j 
MARK --set-mark <mark value>
ip rule add prio 1 fwmark <mark value> table 12
ip route add default via 192.168.1.1 table 12


But doing the following, it works perfectly:

iptables -t mangle -A OUTPUT -m owner --gid-owner <group of process> -j 
TOS --set-tos <tos value>
ip rule add prio 1 tos <tos value> table 12
ip route add default via 192.168.1.1 table 12



I had read that MARKing a paquet could trigger the "Rerouting" part, but 
it appears that in the real world, the "Rerouting" part takes place only 
when we actually change something in the packet like TOSing it or 
DNATing it.

Is this a bug, or is it supposed to work that way? Is there anyway of 
doing what I want using MARKs (and without having to use the ROUTE target)?

I'm using iptables 1.3.7 with unpatched debian etch kernel 2.6.18-4.

Thank you,
François.

Re-routing of output traffic

[François Delawarde]

Hello all!

If i'm not wrong, outgoing traffic generated by local processes pass
through the following:

Local Process ==> OUTPUT [mangle] ==> OUTPUT [nat] ==> Rerouting ==>
OUTPUT [filter] ==> POSTROUTING ...


I'm interested in using a specific routing table for one of my local
processes (the entire story is complicated).

I tried the following without success:

iptables -t mangle -A OUTPUT -m owner --gid-owner <group of process> -j
MARK --set-mark <mark value>
ip rule add prio 1 fwmark <mark value> table 12
ip route add default via 192.168.1.1 table 12


But doing the following, it works perfectly:

iptables -t mangle -A OUTPUT -m owner --gid-owner <group of process> -j
TOS --set-tos <tos value>
ip rule add prio 1 tos <tos value> table 12
ip route add default via 192.168.1.1 table 12



I had read that MARKing a paquet could trigger the "Rerouting" part, but
it appears that in the real world, the "Rerouting" part takes place only
when we actually change something in the packet like TOSing it or
DNATing it.

Is this a bug, or is it supposed to work that way? Is there anyway of
doing what I want using MARKs (and without having to use the ROUTE target)?

I'm using iptables 1.3.7 with unpatched debian etch kernel 2.6.18-4.

Thank you,
François.