From: Jose Luis Domingo Lopez <lartc@24x7linux.com>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] owner based policy routing
Date: Fri, 11 Oct 2002 21:30:25 +0000 [thread overview]
Message-ID: <marc-lartc-103437188824655@msgid-missing> (raw)
In-Reply-To: <marc-lartc-103430921730225@msgid-missing>
On Friday, 11 October 2002, at 09:34:38 +0530,
Arindam Haldar wrote:
> THE SCENARIO:
> we are connected to 2 isp, both having their large network.. isp A has
> gateway with ofc network while ispB has satellite gateway & hence there
> are advantages to take specific routes thru specific isp.
>
I suppose this box has three network connections, one to the internal
network, and one for each Internet connection. So, for the traffic
coming from the internal network, this box is a router.
> THE RULES DEFINED:
> 10: from all lookup main
>
"ip rule" are checked from lower to higher numbers, so once visited
"table local" (prio 0) all your traffic (from all) visits "table main".
I suppose "table main" doesn't have a default route of some sort,
because that would stop packet routing at that point, turning the rest
of "ip rule" useless.
> WHAT WE TRIED:
> we tried using iptables owner based rules & marked packets( as one can
> see in rules above), but it didnt help.
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 202.0.0.0/8
> -j MARK --set-mark 50
> but packets were not marked as seen by >> iptables -nvL -t mangle
> & hence owner based pilicy routing not working
>
If "iptable -t mangle -L -vn" shows no matches, it can be for two
reasons: either destination address doesn't match, or uid-owner doesn't
match. I have never used "--match owner" myself, but a quick try here
seems to work, at least for a simple network application.
Maybe squid runs as user "squid" (or whatever), but netfilter sees them
as originating from another user, maybe root, maybe no user at all.
--
Jose Luis Domingo Lopez
Linux Registered User #189436 Debian Linux Woody (Linux 2.4.18-586tsc)
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
next prev parent reply other threads:[~2002-10-11 21:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
2002-10-11 21:30 ` Jose Luis Domingo Lopez [this message]
2002-10-11 21:57 ` Julian Anastasov
2002-10-14 12:33 ` Arindam Haldar
2002-10-14 14:26 ` Thilo Schulz
2002-10-14 21:34 ` Julian Anastasov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-103437188824655@msgid-missing \
--to=lartc@24x7linux.com \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.