routing based on MARK problem

routing based on MARK problem

[Pawel]

Hi all,

In my network routing based on MARK do not work. Return packets (SYN - 
ACK) do not reach client.


My network :


local area -------
                         |
                         |--------------eth0 server eth1 -------------- 
provider 1
                         |
external  N------ 
I want to assure access to "external N " from "local area"
I prepared new routing table :

ip rule add fwmark 5 table EXTERNAL
ip route add default via $EXTERNAL_NETWORK_GW_IP dev eth0 table EXTERNAL

next iptable rules:

iptables -t nat PREROUTING -t mangle -i eth0 [DST PORT/ADDRESSES RULES] 
-j MARK  --set-mark 5
to disable NAT and redirection to proxy:

iptables -t nat PREROUTING -m mark --mark 5 -j ACCPET
iptables -t nat POSTROUTING -m mark --mark 5 -j ACCPET

tcpdump on "server"  shows:
"local area IP " > "external N IP"  SYNC
"local area IP" > "external N IP"  SYNC
"external N IP"  > "local area IP " SYNC ACK

last packet appears only once  - that packet to not each host in local area

accept_reidirection and send_reisrections are disabled


What is wrong ?
Thanks for any suggestions.

Pawel