* iptables MARK + ip rule fwmark NOT working with load balance [not found] <AANLkTinT4NGYFPSCA43b9+6RYATe+WtN1Yh7_0HGM3pp@mail.gmail.com> @ 2011-01-25 19:19 ` Davi Baldin Tavares 2011-01-25 19:56 ` Eric Dumazet 0 siblings, 1 reply; 3+ messages in thread From: Davi Baldin Tavares @ 2011-01-25 19:19 UTC (permalink / raw) To: netfilter-devel Hello List, I have two NICs (eth1 and eth2) on my box, each one connected over a different ISP and both are configured in loadbalance (nexthop bla bla). I'm unable to use a specific interface by marking packets with iptables MARK/CONNMARK regardless the load-balancing on the box. I would like to set up for example all SMTP traffic (locally generated or not) going out only by the eth2, however, I can't see this working out. My setup is: # iptables -t mangle -L -n -v Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes) pkts bytes target prot opt in out source destination 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW CONNMARK set 0x81 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0 0.0.0.0/0 state NEW CONNMARK set 0x82 7657 670K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes) pkts bytes target prot opt in out source destination 32 2099 CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82 32 2099 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 MARK set 0x82 (As you can see, packages are being marked). # ip rule list 0: from all lookup 255 3: from all fwmark 0x82 lookup link2 3: from all fwmark 0x81 lookup link1 10: from 200.174.194.44 lookup link2 10: from 201.26.37.40 lookup link1 32766: from all lookup main 32767: from all lookup default # ip route list 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 default nexthop via 200.174.194.41 dev eth3 weight 1 nexthop via 201.26.37.1 dev eth2 weight 3 At this point the mark 0x82 is related to the link on the eth3 (net 200.174.194.41). However, using this setup, the outgoing packets almost always came from eth2 (which has a bigger weight on the balance). I believe the balance is working (and acting on this case) and the mark and route from a specific interface is not. Do you happen to know something that could give me some light or directions on order to put this working fine? Cheers, Davi -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: iptables MARK + ip rule fwmark NOT working with load balance 2011-01-25 19:19 ` iptables MARK + ip rule fwmark NOT working with load balance Davi Baldin Tavares @ 2011-01-25 19:56 ` Eric Dumazet 2011-01-25 20:06 ` Davi Baldin Tavares 0 siblings, 1 reply; 3+ messages in thread From: Eric Dumazet @ 2011-01-25 19:56 UTC (permalink / raw) To: Davi Baldin Tavares; +Cc: netfilter-devel Le mardi 25 janvier 2011 à 17:19 -0200, Davi Baldin Tavares a écrit : > Hello List, > > I have two NICs (eth1 and eth2) on my box, each one connected over a > different ISP and both are configured in loadbalance (nexthop bla > bla). > > I'm unable to use a specific interface by marking packets with > iptables MARK/CONNMARK regardless the load-balancing on the box. I > would like to set up for example all SMTP traffic (locally generated > or not) going out only by the eth2, however, I can't see this working > out. > > My setup is: > > # iptables -t mangle -L -n -v > Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes) > pkts bytes target prot opt in out source destination > 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0 > 0.0.0.0/0 state NEW CONNMARK set 0x81 > 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0 > 0.0.0.0/0 state NEW CONNMARK set 0x82 > 7657 670K CONNMARK all -- * * 0.0.0.0/0 > 0.0.0.0/0 CONNMARK restore > > Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes) > pkts bytes target prot opt in out source destination > 32 2099 CONNMARK tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82 > 32 2099 MARK tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:25 MARK set 0x82 > > (As you can see, packages are being marked). > > # ip rule list > 0: from all lookup 255 > 3: from all fwmark 0x82 lookup link2 > 3: from all fwmark 0x81 lookup link1 same rule numbers 3 and 3 ?? > 10: from 200.174.194.44 lookup link2 > 10: from 201.26.37.40 lookup link1 ditto > 32766: from all lookup main > 32767: from all lookup default > > # ip route list > 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 > 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 > default > nexthop via 200.174.194.41 dev eth3 weight 1 > nexthop via 201.26.37.1 dev eth2 weight 3 > > At this point the mark 0x82 is related to the link on the eth3 (net > 200.174.194.41). However, using this setup, the outgoing packets > almost always came from eth2 (which has a bigger weight on the > balance). I believe the balance is working (and acting on this case) > and the mark and route from a specific interface is not. > > Do you happen to know something that could give me some light or > directions on order to put this working fine? Hello What is your kernel version ? ip route list table link2 ip route list table link1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: iptables MARK + ip rule fwmark NOT working with load balance 2011-01-25 19:56 ` Eric Dumazet @ 2011-01-25 20:06 ` Davi Baldin Tavares 0 siblings, 0 replies; 3+ messages in thread From: Davi Baldin Tavares @ 2011-01-25 20:06 UTC (permalink / raw) To: netfilter-devel Hi, CentOS release 5.5 (Final) 2.6.18-194.32.1.el5 #1 SMP Wed Jan 5 17:53:09 EST 2011 i686 i686 i386 GNU/Linux # ip route list table link1 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 192.168.19.0/24 dev eth0 proto kernel scope link src 192.168.19.2 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 default via 201.26.37.1 dev eth2 # ip route list table link2 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 192.168.19.0/24 dev eth0 proto kernel scope link src 192.168.19.2 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 default via 200.174.194.41 dev eth3 I've a script that copy the routes from main table to the link`s table. This is a trick I have heard in order to keep route up an running for everywhere.... Cheers, Davi 2011/1/25 Eric Dumazet <eric.dumazet@gmail.com>: > Le mardi 25 janvier 2011 à 17:19 -0200, Davi Baldin Tavares a écrit : >> Hello List, >> >> I have two NICs (eth1 and eth2) on my box, each one connected over a >> different ISP and both are configured in loadbalance (nexthop bla >> bla). >> >> I'm unable to use a specific interface by marking packets with >> iptables MARK/CONNMARK regardless the load-balancing on the box. I >> would like to set up for example all SMTP traffic (locally generated >> or not) going out only by the eth2, however, I can't see this working >> out. >> >> My setup is: >> >> # iptables -t mangle -L -n -v >> Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes) >> pkts bytes target prot opt in out source destination >> 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0 >> 0.0.0.0/0 state NEW CONNMARK set 0x81 >> 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0 >> 0.0.0.0/0 state NEW CONNMARK set 0x82 >> 7657 670K CONNMARK all -- * * 0.0.0.0/0 >> 0.0.0.0/0 CONNMARK restore >> >> Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes) >> pkts bytes target prot opt in out source destination >> 32 2099 CONNMARK tcp -- * * 0.0.0.0/0 >> 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82 >> 32 2099 MARK tcp -- * * 0.0.0.0/0 >> 0.0.0.0/0 tcp dpt:25 MARK set 0x82 >> >> (As you can see, packages are being marked). >> >> # ip rule list >> 0: from all lookup 255 >> 3: from all fwmark 0x82 lookup link2 >> 3: from all fwmark 0x81 lookup link1 > > same rule numbers 3 and 3 ?? >> 10: from 200.174.194.44 lookup link2 >> 10: from 201.26.37.40 lookup link1 > > ditto > >> 32766: from all lookup main >> 32767: from all lookup default >> >> # ip route list >> 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 >> 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 >> default >> nexthop via 200.174.194.41 dev eth3 weight 1 >> nexthop via 201.26.37.1 dev eth2 weight 3 >> >> At this point the mark 0x82 is related to the link on the eth3 (net >> 200.174.194.41). However, using this setup, the outgoing packets >> almost always came from eth2 (which has a bigger weight on the >> balance). I believe the balance is working (and acting on this case) >> and the mark and route from a specific interface is not. >> >> Do you happen to know something that could give me some light or >> directions on order to put this working fine? > > Hello > > What is your kernel version ? > > ip route list table link2 > ip route list table link1 > > > > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-01-25 20:07 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <AANLkTinT4NGYFPSCA43b9+6RYATe+WtN1Yh7_0HGM3pp@mail.gmail.com>
2011-01-25 19:19 ` iptables MARK + ip rule fwmark NOT working with load balance Davi Baldin Tavares
2011-01-25 19:56 ` Eric Dumazet
2011-01-25 20:06 ` Davi Baldin Tavares
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).