iptables MARK + ip rule fwmark NOT working with load balance

[Davi Baldin Tavares <davi@presentia.com.br>]

Hello List,

I have two NICs (eth1 and eth2) on my box, each one connected over a
different ISP and both are configured in loadbalance (nexthop bla
bla).

I'm unable to use a specific interface by marking packets with
iptables MARK/CONNMARK regardless the load-balancing on the box. I
would like to set up for example all SMTP traffic (locally generated
or not) going out only by the eth2, however, I can't see this working
out.

My setup is:

# iptables -t mangle -L -n -v
Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes)
 pkts bytes target     prot opt in     out     source               destination
  810 35766 CONNMARK   all  --  eth2   *       0.0.0.0/0
0.0.0.0/0           state NEW CONNMARK set 0x81
   19  2810 CONNMARK   all  --  eth3   *       0.0.0.0/0
0.0.0.0/0           state NEW CONNMARK set 0x82
 7657  670K CONNMARK   all  --  *      *       0.0.0.0/0
0.0.0.0/0           CONNMARK restore

Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes)
 pkts bytes target     prot opt in     out     source               destination
   32  2099 CONNMARK   tcp  --  *      *       0.0.0.0/0
0.0.0.0/0           tcp dpt:25 CONNMARK set 0x82
   32  2099 MARK       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0           tcp dpt:25 MARK set 0x82

(As you can see, packages are being marked).

# ip rule list
0:      from all lookup 255
3:      from all fwmark 0x82 lookup link2
3:      from all fwmark 0x81 lookup link1
10:     from 200.174.194.44 lookup link2
10:     from 201.26.37.40 lookup link1
32766:  from all lookup main
32767:  from all lookup default

# ip route list
200.174.194.40/29 dev eth3  proto kernel  scope link  src 200.174.194.44
201.26.37.0/24 dev eth2  proto kernel  scope link  src 201.26.37.40
default
        nexthop via 200.174.194.41  dev eth3 weight 1
        nexthop via 201.26.37.1  dev eth2 weight 3

At this point the mark 0x82 is related to the link on the eth3 (net
200.174.194.41). However, using this setup, the outgoing packets
almost always came from eth2 (which has a bigger weight on the
balance). I believe the balance is working (and acting on this case)
and the mark and route from a specific interface is not.

Do you happen to know something that could give me some light or
directions on order to put this working fine?

Cheers,

Davi
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html