-j ROUTE and conntrack

-j ROUTE and conntrack

[Paul Evans]

Our outbound traffic gets SNATted to claim to come from one of several
role IPs. These IPs are hosted on different routers for load
distribution purposes. The choice of which role IP to use depends on
the exact destination IP address / TCP port number the connection goes
to.

I'm using the "-j ROUTE" target to force a routing decision for this,
but it seems to have the side effect of breaking conntrack. Without -j
ROUTE, the outbound connection appears in the conntrack table, so that
when incoming replies arrive, they pass an ESTABLISHED test, and are
let in. If it needs to -j ROUTE on the way out, then when the reply
comes back, no conntrack entry means it fails ESTABLISHED and gets
dropped. It seems that "-j ROUTE --continue" doesn't help either, it
still goes missing.

Can anyone shed any light on this? How to keep the entry in conntrack
even though using -j ROUTE. Failing that, how else to perform a routing
decision override in a way that won't break conntrack?

-- 
Paul Evans <paul@mxtelecom.com>
Tel: +44 (0) 845 666 7778
Fax: +44 (0) 870 163 4694
http://www.mxtelecom.com

Re: -j ROUTE and conntrack

[Paul Evans]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

On Wed, 29 Oct 2008 15:46:50 +0000
Paul Evans <paul@mxtelecom.com> wrote:

> I'm using the "-j ROUTE" target to force a routing decision for this,
> but it seems to have the side effect of breaking conntrack. Without -j
> ROUTE, the outbound connection appears in the conntrack table, so that
> when incoming replies arrive, they pass an ESTABLISHED test, and are
> let in. If it needs to -j ROUTE on the way out, then when the reply
> comes back, no conntrack entry means it fails ESTABLISHED and gets
> dropped. It seems that "-j ROUTE --continue" doesn't help either, it
> still goes missing.

Actually, this seems to be my mistake. There's an unfortunate
side-effect of giving ROUTE the --continue option when called from
PREROUTING. The packet exits the PREROUTING chain already with a
routing decision made in it before it hits the kernel's routing core
which seems to confuse it. It then drops the packet and the
conntrack information associated.

I've moved the ROUTE calls into POSTROUTING and now it seems to work
fine - it routes correctly, it remains in conntrack so the reply passes
the ESTABLISHED test.

-- 
Paul Evans <paul@mxtelecom.com>
Tel: +44 (0) 845 666 7778
Fax: +44 (0) 870 163 4694
http://www.mxtelecom.com

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 197 bytes --]