Re: iptables MARK + ip rule fwmark NOT working with load balance

[Davi Baldin Tavares <davi@presentia.com.br>]

Hi,
CentOS release 5.5 (Final)
2.6.18-194.32.1.el5 #1 SMP Wed Jan 5 17:53:09 EST 2011 i686 i686 i386 GNU/Linux

# ip route list table link1
200.174.194.40/29 dev eth3  proto kernel  scope link  src 200.174.194.44
192.168.19.0/24 dev eth0  proto kernel  scope link  src 192.168.19.2
201.26.37.0/24 dev eth2  proto kernel  scope link  src 201.26.37.40
default via 201.26.37.1 dev eth2

# ip route list table link2
200.174.194.40/29 dev eth3  proto kernel  scope link  src 200.174.194.44
192.168.19.0/24 dev eth0  proto kernel  scope link  src 192.168.19.2
201.26.37.0/24 dev eth2  proto kernel  scope link  src 201.26.37.40
default via 200.174.194.41 dev eth3

I've a script that copy the routes from main table to the link`s
table. This is a trick I have heard in order to keep route up an
running for everywhere....

Cheers,

Davi



2011/1/25 Eric Dumazet <eric.dumazet@gmail.com>:
> Le mardi 25 janvier 2011 à 17:19 -0200, Davi Baldin Tavares a écrit :
>> Hello List,
>>
>> I have two NICs (eth1 and eth2) on my box, each one connected over a
>> different ISP and both are configured in loadbalance (nexthop bla
>> bla).
>>
>> I'm unable to use a specific interface by marking packets with
>> iptables MARK/CONNMARK regardless the load-balancing on the box. I
>> would like to set up for example all SMTP traffic (locally generated
>> or not) going out only by the eth2, however, I can't see this working
>> out.
>>
>> My setup is:
>>
>> # iptables -t mangle -L -n -v
>> Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes)
>>  pkts bytes target     prot opt in     out     source               destination
>>   810 35766 CONNMARK   all  --  eth2   *       0.0.0.0/0
>> 0.0.0.0/0           state NEW CONNMARK set 0x81
>>    19  2810 CONNMARK   all  --  eth3   *       0.0.0.0/0
>> 0.0.0.0/0           state NEW CONNMARK set 0x82
>>  7657  670K CONNMARK   all  --  *      *       0.0.0.0/0
>> 0.0.0.0/0           CONNMARK restore
>>
>> Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes)
>>  pkts bytes target     prot opt in     out     source               destination
>>    32  2099 CONNMARK   tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0           tcp dpt:25 CONNMARK set 0x82
>>    32  2099 MARK       tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0           tcp dpt:25 MARK set 0x82
>>
>> (As you can see, packages are being marked).
>>
>> # ip rule list
>> 0:      from all lookup 255
>> 3:      from all fwmark 0x82 lookup link2
>> 3:      from all fwmark 0x81 lookup link1
>
> same rule numbers 3 and 3 ??
>> 10:     from 200.174.194.44 lookup link2
>> 10:     from 201.26.37.40 lookup link1
>
> ditto
>
>> 32766:  from all lookup main
>> 32767:  from all lookup default
>>
>> # ip route list
>> 200.174.194.40/29 dev eth3  proto kernel  scope link  src 200.174.194.44
>> 201.26.37.0/24 dev eth2  proto kernel  scope link  src 201.26.37.40
>> default
>>         nexthop via 200.174.194.41  dev eth3 weight 1
>>         nexthop via 201.26.37.1  dev eth2 weight 3
>>
>> At this point the mark 0x82 is related to the link on the eth3 (net
>> 200.174.194.41). However, using this setup, the outgoing packets
>> almost always came from eth2 (which has a bigger weight on the
>> balance). I believe the balance is working (and acting on this case)
>> and the mark and route from a specific interface is not.
>>
>> Do you happen to know something that could give me some light or
>> directions on order to put this working fine?
>
> Hello
>
> What is your kernel version ?
>
> ip route list table link2
> ip route list table link1
>
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html