MARKing question

MARKing question

[Askar]

hi list, 

I'm MARKing packets in PREROUTING of mangle with the below rule to
route them from other route then the default route .(iproute2 +
iptables)

$iptables -A PREROUTING -i eth0 -t mangle -s 202.xxx.xxx.0/24 -d 0/0
-p tcp --dport 80 -j MARK --set-mark 4

What I want is to exclude a single IP from the above to be MARKed, i-e
the particular IP packets goes through default route of the firewall
machine not through iproute2 route.

Is this possible with iptables or I have to apply pom (extentions) to
accomplished this?

regards

Askar

(after bouncing head on desk for days trying to get mine working, I'll make
your life a little easier)

Re: MARKing question

[Jason Opperisano]

On Mon, Jan 31, 2005 at 03:29:32PM +0500, Askar wrote:
> hi list, 
> 
> I'm MARKing packets in PREROUTING of mangle with the below rule to
> route them from other route then the default route .(iproute2 +
> iptables)
> 
> $iptables -A PREROUTING -i eth0 -t mangle -s 202.xxx.xxx.0/24 -d 0/0
> -p tcp --dport 80 -j MARK --set-mark 4
> 
> What I want is to exclude a single IP from the above to be MARKed, i-e
> the particular IP packets goes through default route of the firewall
> machine not through iproute2 route.
> 
> Is this possible with iptables or I have to apply pom (extentions) to
> accomplished this?

two thoughts:  1) ACCEPT the packet from the "excluded IP" prior to the
mark rule or 2) reset the MARK on packets from the "excluded IP" after
the mark rule.

version 1:

  iptables -t mangle -A PREROUTING -i eth0 -p tcp -s $EXCLUDED_IP \
    --dport 80 -j ACCEPT

  iptables -t mangle -A PREROUTING -i eth0 -p tcp -s 202.xxx.xxx.0/24 \
    --dport 80 -j MARK --set-mark 4

version 2:

  iptables -t mangle -A PREROUTING -i eth0 -p tcp -s 202.xxx.xxx.0/24 \
    --dport 80 -j MARK --set-mark 4

  iptables -t mangle -A PREROUTING -i eth0 -p tcp -s $EXCLUDED_IP \
    --dport 80 -j MARK --set-mark 0

version 1 gets packets from $EXCLUDED_IP out of the mangle PREROUTING
chain as quickly as possible.

version 2 allows packets from $EXCLUDED_IP to continue to traverse
mangle PREROUTING in case you want to do other stuff to it.

which one is "better" would depend on your specific situation.

-j

--
"I saw this in a movie about a bus that had to SPEED around a city,
 keeping its SPEED over fifty, and if its SPEED dropped, it would
 explode. I think it was called, 'The Bus That Couldn't Slow Down.'"
        --The Simpsons

Re: MARKing question

[Askar]

On Mon, 31 Jan 2005 11:25:31 -0500, Jason Opperisano <opie@817west.com> wrote:
> On Mon, Jan 31, 2005 at 03:29:32PM +0500, Askar wrote:
> > hi list,
> >
> > I'm MARKing packets in PREROUTING of mangle with the below rule to
> > route them from other route then the default route .(iproute2 +
> > iptables)
> >
> > $iptables -A PREROUTING -i eth0 -t mangle -s 202.xxx.xxx.0/24 -d 0/0
> > -p tcp --dport 80 -j MARK --set-mark 4
> >
> > What I want is to exclude a single IP from the above to be MARKed, i-e
> > the particular IP packets goes through default route of the firewall
> > machine not through iproute2 route.
> >
> > Is this possible with iptables or I have to apply pom (extentions) to
> > accomplished this?
> 
> two thoughts:  1) ACCEPT the packet from the "excluded IP" prior to the
> mark rule or 2) reset the MARK on packets from the "excluded IP" after
> the mark rule.
> 
> version 1:
> 
>   iptables -t mangle -A PREROUTING -i eth0 -p tcp -s $EXCLUDED_IP \
>     --dport 80 -j ACCEPT
> 
>   iptables -t mangle -A PREROUTING -i eth0 -p tcp -s 202.xxx.xxx.0/24 \
>     --dport 80 -j MARK --set-mark 4
Thanks jason, i go with version 2 and it worked

> 
> version 2:
> 
>   iptables -t mangle -A PREROUTING -i eth0 -p tcp -s 202.xxx.xxx.0/24 \
>     --dport 80 -j MARK --set-mark 4
> 
>   iptables -t mangle -A PREROUTING -i eth0 -p tcp -s $EXCLUDED_IP \
>     --dport 80 -j MARK --set-mark 0
> 
> version 1 gets packets from $EXCLUDED_IP out of the mangle PREROUTING
> chain as quickly as possible.
> 
> version 2 allows packets from $EXCLUDED_IP to continue to traverse
> mangle PREROUTING in case you want to do other stuff to it.
> 
> which one is "better" would depend on your specific situation.
> 
> -j
> 
> --
> "I saw this in a movie about a bus that had to SPEED around a city,
>  keeping its SPEED over fifty, and if its SPEED dropped, it would
>  explode. I think it was called, 'The Bus That Couldn't Slow Down.'"
>         --The Simpsons
> 
> 


-- 
(after bouncing head on desk for days trying to get mine working, I'll make
your life a little easier)