Re: conntrackd + mark problems

[Pablo Neira Ayuso <pablo@netfilter.org>]

Igor Neves wrote:
> Hi,
> 
> First of all, i would like to thanks you, for your great your.
> 
> I have setup two firewalls with conntrackd in Centos 5, and everything
> it's ok and working as it should. By the way I have used heartbeat as HA
> manager, for that I have to develop conntrackd init script, and one ocf
> script for heartbeat. There are any interest in adding them to tree?

If they are generic enough to help others to set up hearbeat +
conntrackd, I'll be fine with it. Please, send them to me so I can check
them and don't forget to add the corresponding credits.

> I just have found one problem, in this 2 firewalls I need to setup
> "Policy Routing" and "Policy Shaper", but our solutions are based on
> mark's.
> 
> I noticed that when the the backup firewall takes over the service(go to
> primary), and the primary goes to state backup, the connmark connections
> move from one to the other without any problem but it does not take the
> mark with it, it always insert the rule in the new primary with "mark=0".
> 
> Is this a configuration problem? A todo item? A bug?

Looking at the archives, conntrack-tools >= 0.9.5 and Linux kernel >=
2.6.20 supports connmarking. Please, try to guess where the connmark is
getting lost:

(in the primary) # conntrack -L                # shows kernel table
(in the primary) # conntrackd -i               # shows userspace cache
(in the backup)# conntrackd -e                 # shows external cache

They all should show the connmark. And also try:

# conntrack -I -s 1.1.1.1 -d 2.2.2.2 -p tcp --sport 1111 --dport 2222 -t
10 -u SEEN_REPLY --state SYN_SENT -m 1

This lines creates an entry manually with the command line tool - line
above. Please, check that the mark is set.

> Thanks for your help,
> PS: I know I should send this to the list, but I'm not subscribed, sorry.

I'm Cc'ing netfilter users mailing list, just to keep this for the record.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers