Re: [LARTC] ip rule and transparent proxy.

[Esteban Ribicic <eribicic@UolSinectis.com>]

after marking the packet, it is posible to route over ip (marking in
output)...packet goes to the gw you choose..routeing after is other
issue, as you cant know or predict what will do your isp router.

the packet will go where you told him to go (through fwmarks) with src
address as kernel algorithm says so (probably, if not bind() called, the
ip address of the interface on wich the default gw is setted)..

if the src address of the packet does not match with the interface you
choose, is probably that the packet leaves the interface and never come
back -my scpecial case, is that my two links are from the same isp and
they route the packet trgout a default route in their router- ..so
packets leaves from one interface and comes in the other... but, you can
(i hvent tryed this, but i think it should work) nat the src adress and
packet will go and come....maybe you shlud nat the packet again when it
comes...
example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for
example..

i have working hwat i said on my linux box for squid packets..the go
from one interface and come in the other.

steve

On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote:
> Esteban Ribicic wrote:
> 
> >you should try marking squid packets (output chain for example) and then
> >add a rule (ip rule ls)..
> >in lartc.org http://www.lartc.org/lartc.pdf have plenty of examples.
> >  
> >
> 
>    Unfortunately, this will not work.  It is not possible to route a 
> locally-generated packet using a firewall mark because the routing 
> decision is taken before the packet is sent to the MANGLE OUTPUT chain. 
>   Routing a packet using a firewall mark works only in the PREROUTING 
> Netfilter hook.
> 
> Stephane Ouellette
> 
> >tips: when marking packets on iptables, use hexa not decimal notting.
> >try patching the kernel if does not work (http://www.ssi.bg/~ja/) cause
> >kernel default source may not work...
> >
> >and its probably that squid use as source adrres of ip header the ip on
> >the default route, so you might have to nat that src to the other
> >interface (so packets leave the interface you want and come back in that
> >interface and not the other -if they come..- )
> >
> >greets and good speed.
> >
> >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> >  
> >
> 

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/