Re: CONNMARK udp comprehension question

["Jörg Lübbert" <j.luebbert@login-lanstation.de>]

This might help you without the need to mess with marks.

For each uplink interface with an incremental $x

ip route add default via $gateway_ip dev $uplink_interface table $x
ip rule add from $ip_of_interface dev $uplink_interface table $x

alternatively use -j CONNMARK --restore-mark in -t mangle PREROUTING so 
that ip rules can match the mark or as a 3rd option use the ROUTE target.

- Jörg

Peter Warasin schrieb:
> Hi List
> 
> Have a question in order to understand if i am tilting at windmills or
> if there's an issue with my setup.
> 
> Here a short description of my scenario to help me to explain myself:
> 
> I have a box with multiple uplinks running openvpn in udp mode. One of
> the uplinks has the default gateway (no multipath route). Now, whenever
> i connect to an uplink which actually hasn't the default gateway,
> packets go in through that device and exit through another (due to the
> default gateway), which will break the udp-"connection".
> 
> Now, the question:
> I mark all connections entering a specific uplink with a number using
> CONNMARK, in order to be able to distinguish them and make them leave
> the correct interface using fwmark based ip rules.
> 
> Shouldn't now the CONNMARK target, mark the connection in such a manner
> that the udp packets coming in have the same mark as the udp packets
> going out whenever they belong to the same "connection"?
> Or is this just not possible due to the connection-less nature of udp?
> 
> Same setup works for me with tcp and it also works with udp when the
> connections going through the box (FORWARD).
> 
> Kernel is RH'L5.1's kernel-2.6.18-53 with all relevant options enabled
> and iptables 1.3.8.
> 
> Any help would be greatly appreciated!
> 
> peter
>