From mboxrd@z Thu Jan  1 00:00:00 1970
From: Jeff Cook <jeff@deserettechnology.com>
Subject: Re: Packets marked by iptables only sent to the correct routing table
 sometimes
Date: Tue, 30 Oct 2012 17:25:16 -0600
Message-ID: <509061DC.3090606@deserettechnology.com>
References: <50900C7D.2010300@deserettechnology.com> <20121030191034.GA21096@1984> <20121030191610.GA23663@1984>
Reply-To: jeff@deserettechnology.com
Mime-Version: 1.0
Content-Transfer-Encoding: 7BIT
Return-path: <netfilter-owner@vger.kernel.org>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=sender:message-id:date:from:reply-to:user-agent:mime-version:to:cc
         :subject:references:in-reply-to:x-enigmail-version:content-type
         :content-transfer-encoding;
        bh=SunxdI8KhK05rSWtaspvZn1iOBQnIFnH0O7+oI1w6I8=;
        b=J1wO/zW4KIKjaAn/4B+hk55XKnHUUqp8kbZBNFmv8LmcI0BYOD4+eSYFYUFpWS95mA
         CEssEsQKJdRnzwFoY6fOpjY9AyLN4aBWWaTPZ9sBS008j6TM/VMtMpmaP0k6APEO6vKe
         dX7RjVU8oeWC2MynVaCsd9R96Zt6G6qwuy++108WLfYcndrz5axwepAdoCjLxSbxGEUA
         cIFlYvlQ0LTfvxtoJbXUK+rS5xYZQenxU3dfESxeW9O/6HcIh9787E8JxRlWK6aZG0iR
         ggbcTkXRKwPFpdqKKAYV4m4N2cG4zVtXvnSQN20nRZGmhqHGRaw0FGFmFZMwW4eEUD3p
         yB6w==
In-Reply-To: <20121030191610.GA23663@1984>
Sender: netfilter-owner@vger.kernel.org
List-ID: <netfilter.vger.kernel.org>
Content-Type: text/plain; charset="us-ascii"
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter@vger.kernel.org, kaber@trash.net

On 10/30/2012 01:16 PM, Pablo Neira Ayuso wrote:
> On Tue, Oct 30, 2012 at 08:10:34PM +0100, Pablo Neira Ayuso wrote:
>> On Tue, Oct 30, 2012 at 11:21:01AM -0600, Jeff Cook wrote:
>>> Hello.
>>>
>>> I am trying to route packets generated by a specific user out over a
>>> VPN. I have this configuration:
>>>
>>>     $ sudo iptables -S -t nat
>>>     -P PREROUTING ACCEPT
>>>     -P OUTPUT ACCEPT
>>>     -P POSTROUTING ACCEPT
>>>     -A POSTROUTING -o tun0 -j MASQUERADE
>>>
>>>     $ sudo iptables -S -t mangle
>>>     -P PREROUTING ACCEPT
>>>     -P INPUT ACCEPT
>>>     -P FORWARD ACCEPT
>>>     -P OUTPUT ACCEPT
>>>     -P POSTROUTING ACCEPT
>>>     -A OUTPUT -m owner --uid-owner guy -j MARK --set-xmark 0xb/0xffffffff
>>>
>>>     $ sudo ip rule show
>>>     0:      from all lookup local
>>>     32765:  from all fwmark 0xb lookup 11
>>>     32766:  from all lookup main
>>>     32767:  from all lookup default
>>>
>>>     $ sudo ip route show table 11
>>>     10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6
>>>     10.8.0.6 dev tun0  scope link
>>>     10.8.0.1 via 10.8.0.5 dev tun0
>>>     0.0.0.0/1 via 10.8.0.5 dev tun0
>>       ^^^^^^^^^
>>
>> 23.1.17.194, this doesn't go through tun0
> 
> Sorry, I meant: 23.1.17.194, this goes through tun0.
> 
>> 209.68.27.16, this doesn't go through tun0
>>
>> Address & CIDR => 209.68.27.16 & 128.0.0.0 => 128.0.0.0
>>
>> Then: 128.0.0.0 != 0.0.0.0, then go to default route, likely to be
>> eth0.

Thanks very much, I can verify that adding a route for 128.0.0.0/1 to
table 11 fixes things.

Apologies for asking a naive question, but could you please inform me
where 128.0.0.0/1 comes from and why it's ANDed against external IP
addresses? I've tried to find info on Google about 128.0.0.0 and CIDR
and unfortunately have not been able to find anything thus far that
enlightens me as to why that route is necessary. I'd really like to
understand, so if you spend some time explaining it to me I'd appreciate it.

Thanks again for your help. Will send 0.5 btc if you're interested;
please include a Bitcoin deposit address and I will forward over the
funds promptly. :)

Thanks
Jeff