Re: [LARTC] OUTPUT chain marking after or before routing?

["Martin A. Brown" <mabrown-lartc@securepipe.com>]

Catalin,

>When I try to connect to a smtp port somewhere in the Internet, tcpdump show
>me that these packets go to the eth2 interface (the main table default
>route). I don't know where is my mistake but it seems that the marking in
>the OUTPUT chain occurs AFTER and not BEFORE routing. Is this a correct
>behaviour? How can I solve my problem? Please help!

According to my reading of the KPTD (and my understanding), packets
generated on the local machine have already been routed by the time the
OUTPUT chain is traversed.  See:

  http://www.docum.org/stef.coene/qos/kptd/

 : have u tried putting it on the FORWARD chain??

Unfortunately the FORWARD chain will not work if these are locally
generated packets.

I see two potential approaches to this problem:

  - invert your logic; main routing table uses ppp0 gateway IP as default
    gateway, mark all traffic passing through your router box, and use
    "ip rule add fwmark $MARK table $INTERNET" with another routing
    table for the Internet-bound traffic.

  - send all locally generated traffic via ppp0; "ip rule add iif lo
    table smtp" and watch all traffic generated on the local machine leave
    via ppp0.  You'll want to add the locally connected networks to table
    smtp.

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/