From: Marco Gaiarin <gaio@sv.lnf.it>
To: lartc@vger.kernel.org
Subject: Multiple link, policy routing and link not in defaut route...
Date: Wed, 03 Feb 2021 18:15:30 +0000 [thread overview]
Message-ID: <20210203181530.GO3370@lilliput.linux.it> (raw)
Sorry for my prevuìious post, i've done some extensive tests and now i
have more info, i hope at least.
Situation: multiple link firewall, with 4 link to the internet,
'balanced' via route base balancing and policy routing (AKA, iptables
mark).
Situation:
root@tank:~# ip route show
default
nexthop via 81.174.0.21 dev ppp0 weight 30
nexthop via 88.37.116.137 dev vlan192 weight 7
nexthop via 10.5.248.253 dev vlan193 weight 100
there's a fourth link, but i want to 'reserve' it for some specific
traffic. I've excluded from the default route pool, so.
But the specific table routing is here:
root@tank:~# ip rule show
0: from all lookup local
32758: from all fwmark 0x40/0xf0 lookup FWFibra
32759: from 37.186.212.162 lookup FWFibra
32760: from all fwmark 0x30/0xf0 lookup FWFTTC
32761: from 10.5.248.254 lookup FWFTTC
32762: from all fwmark 0x20/0xf0 lookup EOLO
32763: from 88.147.114.200 lookup EOLO
32764: from all fwmark 0x10/0xf0 lookup TI7
32765: from 88.37.116.142 lookup TI7
32766: from all lookup main
32767: from all lookup default
root@tank:~# ip route show table FWFibra
default via 37.186.212.161 dev vlan249
10.5.0.0/21 dev eth0 scope link
10.5.8.0/22 dev eth0.3 scope link
37.186.212.160/30 dev vlan249 scope link src 37.186.212.162
127.0.0.0/8 dev lo scope link
I've added a policy routing test:
/sbin/iptables -t mangle -A PREROUTING -i eth0 -s 10.5.0.0/21 -d 173.194.79.109 -p icmp -m mark --mark 0x0/0xf0 -j MARK --set-mark 64/0x00f0
i can see the rule match, the ping from an internal host go ouside, come
back but nothing arrived on internal host.
I've double checked forward chains and NAT tables, and all seems OK.
After a bit of fiddling, i've tried to add the fourth line to the
'default route' pool, eg:
root@tank:~# ip route show
default
nexthop via 81.174.0.21 dev ppp0 weight 30
nexthop via 88.37.116.137 dev vlan192 weight 7
nexthop via 10.5.248.253 dev vlan193 weight 100
nexthop via 37.186.212.161 dev vlan249 weight 10
and now the policy routing works as expected.
Why the interface need to be in 'default route'? Thanks.
--
dott. Marco Gaiarin GNUPG Key ID: 240A3D66
Associazione ``La Nostra Famiglia'' http://www.lanostrafamiglia.it/
Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN)
marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797
Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
next reply other threads:[~2021-02-03 18:15 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-03 18:15 Marco Gaiarin [this message]
2021-02-05 16:42 ` Multiple link, policy routing and link not in defaut route Marco Gaiarin
2021-02-06 10:30 ` cronolog+lartc
2021-02-08 15:15 ` Marco Gaiarin
2021-02-09 1:47 ` Jay Vosburgh
2021-02-09 17:54 ` Marco Gaiarin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210203181530.GO3370@lilliput.linux.it \
--to=gaio@sv.lnf.it \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox