Re: Packets marked by iptables only sent to the correct routing table sometimes

[Jeff Cook <jeff@deserettechnology.com>]

On 10/30/2012 01:16 PM, Pablo Neira Ayuso wrote:
> On Tue, Oct 30, 2012 at 08:10:34PM +0100, Pablo Neira Ayuso wrote:
>> On Tue, Oct 30, 2012 at 11:21:01AM -0600, Jeff Cook wrote:
>>> Hello.
>>>
>>> I am trying to route packets generated by a specific user out over a
>>> VPN. I have this configuration:
>>>
>>>     $ sudo iptables -S -t nat
>>>     -P PREROUTING ACCEPT
>>>     -P OUTPUT ACCEPT
>>>     -P POSTROUTING ACCEPT
>>>     -A POSTROUTING -o tun0 -j MASQUERADE
>>>
>>>     $ sudo iptables -S -t mangle
>>>     -P PREROUTING ACCEPT
>>>     -P INPUT ACCEPT
>>>     -P FORWARD ACCEPT
>>>     -P OUTPUT ACCEPT
>>>     -P POSTROUTING ACCEPT
>>>     -A OUTPUT -m owner --uid-owner guy -j MARK --set-xmark 0xb/0xffffffff
>>>
>>>     $ sudo ip rule show
>>>     0:      from all lookup local
>>>     32765:  from all fwmark 0xb lookup 11
>>>     32766:  from all lookup main
>>>     32767:  from all lookup default
>>>
>>>     $ sudo ip route show table 11
>>>     10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6
>>>     10.8.0.6 dev tun0  scope link
>>>     10.8.0.1 via 10.8.0.5 dev tun0
>>>     0.0.0.0/1 via 10.8.0.5 dev tun0
>>       ^^^^^^^^^
>>
>> 23.1.17.194, this doesn't go through tun0
> 
> Sorry, I meant: 23.1.17.194, this goes through tun0.
> 
>> 209.68.27.16, this doesn't go through tun0
>>
>> Address & CIDR => 209.68.27.16 & 128.0.0.0 => 128.0.0.0
>>
>> Then: 128.0.0.0 != 0.0.0.0, then go to default route, likely to be
>> eth0.

Thanks very much, I can verify that adding a route for 128.0.0.0/1 to
table 11 fixes things.

Apologies for asking a naive question, but could you please inform me
where 128.0.0.0/1 comes from and why it's ANDed against external IP
addresses? I've tried to find info on Google about 128.0.0.0 and CIDR
and unfortunately have not been able to find anything thus far that
enlightens me as to why that route is necessary. I'd really like to
understand, so if you spend some time explaining it to me I'd appreciate it.

Thanks again for your help. Will send 0.5 btc if you're interested;
please include a Bitcoin deposit address and I will forward over the
funds promptly. :)

Thanks
Jeff