From: "Jan Rathouský" <jan.rathousky@gmail.com>
To: netfilter-devel@vger.kernel.org
Subject: Re: port based routing for local generated connections
Date: Sun, 17 May 2009 10:15:03 +0200 [thread overview]
Message-ID: <a14f8c120905170115s44e7f834t2113f30f97b3555e@mail.gmail.com> (raw)
In-Reply-To: <alpine.LSU.2.00.0905170920130.20778@fbirervta.pbzchgretzou.qr>
2009/5/17 Jan Engelhardt <jengelh@medozas.de>:
>It also applies to local traffic. The packet will be re-evaluated by
>routing if it changed its mark in the OUTPUT chain.
It doesn't work.
debian:/home/houska# iptables -A OUTPUT -t mangle -p tcp --dport 60353
-j MARK --set-mark 100
debian:/home/houska# iptables -A OUTPUT -t mangle -p tcp --dport 60354
-j MARK --set-mark 100
debian:/home/houska# ip route add default via 10.6.6.6 dev ppp0 table cdma
debian:/home/houska# ip rule add from all fwmark 100 table cdma
debian:/home/houska#
debian:/home/houska# iptables -L -t mangle
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
...
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
MARK tcp -- anywhere anywhere tcp
dpt:60353 MARK xset 0x64/0xffffffff
MARK tcp -- anywhere anywhere tcp
dpt:60354 MARK xset 0x64/0xffffffff
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
debian:/home/houska#
debian:/home/houska# ip route ls table cdma
default via 10.6.6.6 dev ppp0
debian:/home/houska#
debian:/home/houska# ip route ls
10.160.3.42 dev ppp0 proto kernel scope link src 10.162.62.199
debian:/home/houska#
debian:/home/houska# ip rule ls
0: from all lookup local
32765: from all fwmark 0x64 lookup cdma
32766: from all lookup main
32767: from all lookup default
debian:/home/houska#
debian:/home/houska# tcptraceroute ip.add.re.ss 60353
connect: Network is unreachable
debian:/home/houska# tcptraceroute ip.add.re.ss 60354
connect: Network is unreachable
debian:/home/houska#
:(
Same problem is with OpenVPN. What am I doing wrong?
Thanks
Jan
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2009-05-17 8:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-05-16 23:28 port based routing for local generated connections Jan Rathouský
2009-05-17 7:21 ` Jan Engelhardt
2009-05-17 8:15 ` Jan Rathouský [this message]
-- strict thread matches above, loose matches on Subject: below --
2009-05-16 23:40 Jan Rathouský
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a14f8c120905170115s44e7f834t2113f30f97b3555e@mail.gmail.com \
--to=jan.rathousky@gmail.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).