* iptables MARK + ip rule fwmark NOT working with load balance
[not found] <AANLkTinT4NGYFPSCA43b9+6RYATe+WtN1Yh7_0HGM3pp@mail.gmail.com>
@ 2011-01-25 19:19 ` Davi Baldin Tavares
2011-01-25 19:56 ` Eric Dumazet
0 siblings, 1 reply; 3+ messages in thread
From: Davi Baldin Tavares @ 2011-01-25 19:19 UTC (permalink / raw)
To: netfilter-devel
Hello List,
I have two NICs (eth1 and eth2) on my box, each one connected over a
different ISP and both are configured in loadbalance (nexthop bla
bla).
I'm unable to use a specific interface by marking packets with
iptables MARK/CONNMARK regardless the load-balancing on the box. I
would like to set up for example all SMTP traffic (locally generated
or not) going out only by the eth2, however, I can't see this working
out.
My setup is:
# iptables -t mangle -L -n -v
Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes)
pkts bytes target prot opt in out source destination
810 35766 CONNMARK all -- eth2 * 0.0.0.0/0
0.0.0.0/0 state NEW CONNMARK set 0x81
19 2810 CONNMARK all -- eth3 * 0.0.0.0/0
0.0.0.0/0 state NEW CONNMARK set 0x82
7657 670K CONNMARK all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK restore
Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes)
pkts bytes target prot opt in out source destination
32 2099 CONNMARK tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82
32 2099 MARK tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:25 MARK set 0x82
(As you can see, packages are being marked).
# ip rule list
0: from all lookup 255
3: from all fwmark 0x82 lookup link2
3: from all fwmark 0x81 lookup link1
10: from 200.174.194.44 lookup link2
10: from 201.26.37.40 lookup link1
32766: from all lookup main
32767: from all lookup default
# ip route list
200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44
201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40
default
nexthop via 200.174.194.41 dev eth3 weight 1
nexthop via 201.26.37.1 dev eth2 weight 3
At this point the mark 0x82 is related to the link on the eth3 (net
200.174.194.41). However, using this setup, the outgoing packets
almost always came from eth2 (which has a bigger weight on the
balance). I believe the balance is working (and acting on this case)
and the mark and route from a specific interface is not.
Do you happen to know something that could give me some light or
directions on order to put this working fine?
Cheers,
Davi
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: iptables MARK + ip rule fwmark NOT working with load balance
2011-01-25 19:19 ` iptables MARK + ip rule fwmark NOT working with load balance Davi Baldin Tavares
@ 2011-01-25 19:56 ` Eric Dumazet
2011-01-25 20:06 ` Davi Baldin Tavares
0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2011-01-25 19:56 UTC (permalink / raw)
To: Davi Baldin Tavares; +Cc: netfilter-devel
Le mardi 25 janvier 2011 à 17:19 -0200, Davi Baldin Tavares a écrit :
> Hello List,
>
> I have two NICs (eth1 and eth2) on my box, each one connected over a
> different ISP and both are configured in loadbalance (nexthop bla
> bla).
>
> I'm unable to use a specific interface by marking packets with
> iptables MARK/CONNMARK regardless the load-balancing on the box. I
> would like to set up for example all SMTP traffic (locally generated
> or not) going out only by the eth2, however, I can't see this working
> out.
>
> My setup is:
>
> # iptables -t mangle -L -n -v
> Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes)
> pkts bytes target prot opt in out source destination
> 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0
> 0.0.0.0/0 state NEW CONNMARK set 0x81
> 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0
> 0.0.0.0/0 state NEW CONNMARK set 0x82
> 7657 670K CONNMARK all -- * * 0.0.0.0/0
> 0.0.0.0/0 CONNMARK restore
>
> Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes)
> pkts bytes target prot opt in out source destination
> 32 2099 CONNMARK tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82
> 32 2099 MARK tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp dpt:25 MARK set 0x82
>
> (As you can see, packages are being marked).
>
> # ip rule list
> 0: from all lookup 255
> 3: from all fwmark 0x82 lookup link2
> 3: from all fwmark 0x81 lookup link1
same rule numbers 3 and 3 ??
> 10: from 200.174.194.44 lookup link2
> 10: from 201.26.37.40 lookup link1
ditto
> 32766: from all lookup main
> 32767: from all lookup default
>
> # ip route list
> 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44
> 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40
> default
> nexthop via 200.174.194.41 dev eth3 weight 1
> nexthop via 201.26.37.1 dev eth2 weight 3
>
> At this point the mark 0x82 is related to the link on the eth3 (net
> 200.174.194.41). However, using this setup, the outgoing packets
> almost always came from eth2 (which has a bigger weight on the
> balance). I believe the balance is working (and acting on this case)
> and the mark and route from a specific interface is not.
>
> Do you happen to know something that could give me some light or
> directions on order to put this working fine?
Hello
What is your kernel version ?
ip route list table link2
ip route list table link1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: iptables MARK + ip rule fwmark NOT working with load balance
2011-01-25 19:56 ` Eric Dumazet
@ 2011-01-25 20:06 ` Davi Baldin Tavares
0 siblings, 0 replies; 3+ messages in thread
From: Davi Baldin Tavares @ 2011-01-25 20:06 UTC (permalink / raw)
To: netfilter-devel
Hi,
CentOS release 5.5 (Final)
2.6.18-194.32.1.el5 #1 SMP Wed Jan 5 17:53:09 EST 2011 i686 i686 i386 GNU/Linux
# ip route list table link1
200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44
192.168.19.0/24 dev eth0 proto kernel scope link src 192.168.19.2
201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40
default via 201.26.37.1 dev eth2
# ip route list table link2
200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44
192.168.19.0/24 dev eth0 proto kernel scope link src 192.168.19.2
201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40
default via 200.174.194.41 dev eth3
I've a script that copy the routes from main table to the link`s
table. This is a trick I have heard in order to keep route up an
running for everywhere....
Cheers,
Davi
2011/1/25 Eric Dumazet <eric.dumazet@gmail.com>:
> Le mardi 25 janvier 2011 à 17:19 -0200, Davi Baldin Tavares a écrit :
>> Hello List,
>>
>> I have two NICs (eth1 and eth2) on my box, each one connected over a
>> different ISP and both are configured in loadbalance (nexthop bla
>> bla).
>>
>> I'm unable to use a specific interface by marking packets with
>> iptables MARK/CONNMARK regardless the load-balancing on the box. I
>> would like to set up for example all SMTP traffic (locally generated
>> or not) going out only by the eth2, however, I can't see this working
>> out.
>>
>> My setup is:
>>
>> # iptables -t mangle -L -n -v
>> Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes)
>> pkts bytes target prot opt in out source destination
>> 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0
>> 0.0.0.0/0 state NEW CONNMARK set 0x81
>> 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0
>> 0.0.0.0/0 state NEW CONNMARK set 0x82
>> 7657 670K CONNMARK all -- * * 0.0.0.0/0
>> 0.0.0.0/0 CONNMARK restore
>>
>> Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes)
>> pkts bytes target prot opt in out source destination
>> 32 2099 CONNMARK tcp -- * * 0.0.0.0/0
>> 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82
>> 32 2099 MARK tcp -- * * 0.0.0.0/0
>> 0.0.0.0/0 tcp dpt:25 MARK set 0x82
>>
>> (As you can see, packages are being marked).
>>
>> # ip rule list
>> 0: from all lookup 255
>> 3: from all fwmark 0x82 lookup link2
>> 3: from all fwmark 0x81 lookup link1
>
> same rule numbers 3 and 3 ??
>> 10: from 200.174.194.44 lookup link2
>> 10: from 201.26.37.40 lookup link1
>
> ditto
>
>> 32766: from all lookup main
>> 32767: from all lookup default
>>
>> # ip route list
>> 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44
>> 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40
>> default
>> nexthop via 200.174.194.41 dev eth3 weight 1
>> nexthop via 201.26.37.1 dev eth2 weight 3
>>
>> At this point the mark 0x82 is related to the link on the eth3 (net
>> 200.174.194.41). However, using this setup, the outgoing packets
>> almost always came from eth2 (which has a bigger weight on the
>> balance). I believe the balance is working (and acting on this case)
>> and the mark and route from a specific interface is not.
>>
>> Do you happen to know something that could give me some light or
>> directions on order to put this working fine?
>
> Hello
>
> What is your kernel version ?
>
> ip route list table link2
> ip route list table link1
>
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-01-25 20:07 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <AANLkTinT4NGYFPSCA43b9+6RYATe+WtN1Yh7_0HGM3pp@mail.gmail.com>
2011-01-25 19:19 ` iptables MARK + ip rule fwmark NOT working with load balance Davi Baldin Tavares
2011-01-25 19:56 ` Eric Dumazet
2011-01-25 20:06 ` Davi Baldin Tavares
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).