Re: still can't route using fwmark

[Thomas Jacob <jacob@internet24.de>]

On Mon, Apr 20, 2009 at 05:15:21PM +0200, Javier Gálvez Guerrero wrote:
> $ sudo iptables -L -t mangle
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> CONNMARK   tcp  --  anywhere             anywhere            state NEW
> tcp spt:rtsp CONNMARK set 0x1

If you are forwarding packets via this host you need the CONNMARK restore
here as well, then you can also drop the CONNMARK restore from the INPUT chain,
PREROUTING is also traversed for packets destined for the local host.

> With this environment I get the same results. I send the first TCP
> packet (SYN, dport 8554) through the interface ra1 (OK) with the IP
> bound to this interface (SNAT OK) and I get the (SYN,ACK) to the same
> IP and through the same interface (OK!), but my application does not
> send the final acknowledgement to the TCP connection establishment
> (ACK), so the RTSP messages are not sent and the client retries over
> and over again the TCP session establishment. 

Your application does not send the ACK in the 3 way handshake, the
client kernel does. Somehow it doesn't receive the SYN,ACK or
the ACK does not reach the point where you're tcpdumping packets. 
Try to sniff as  close to your client app as possible. Could be
a NAT issue. Or maybe rp_filter or something else is breaking
it for you, you could try to enable /proc/sys/net/ipv4/conf/*/log_martians
to see any issues.

> messing up old connections with other videos. I can't understand how
> this can be so difficult to configure. I must be missing something in
> my rules...

Find another general purpose OS where you can do this AT ALL without additional
products. Then we'll talk about what is difficult or not ;=)