Re: CONNMARK and ip rule fwmark

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Jan Engelhardt a écrit :
> 
> On Sunday 2008-03-30 13:23, Franck JONCOURT wrote:
> 
>> What about using the nat table to add your mark on a whole connection
>> instead of using the mangle table ?
> 
> Using the nat table to 'simulate' -m conntrack --ctstate NEW, that's
> just a gross hack IMO.

I agree that the use of the nat table for any purpose not related to NAT 
should be avoided. However the advantage of the nat table is that it 
sees only one packet per connection, while "-m conntrack --ctstate NEW" 
or "-m state --state NEW" may match multiple packets per connection, 
e.g. duplicate TCP SYN or all UDP sent packets in the original direction 
before the first packet sent in the return direction.

>>> If I remove "fwmark 71" in the "ip rule add" command, then it is working,
>>> but has side effects with the following:
>>>
>>> # iptables -t nat -A PREROUTING -p TCP -d publicip -j DNAT --to 10.4.0.1
>>>
>>> My observations seem to tell me, that ip rule is evaluated BEFORE 
>>> iptables rules are applied, so the mark is not set yet.
> 
> See http://jengelh.hopto.org/images/nf-packet-flow.png , routing 
> decision takes place in the middle. (It's called _PRE_ROUTING_ for a 
> reason.)

My understanding is that the side effects mentioned by the OP apply to 
the return packets of DNATed connections, which go through the OUTPUT 
chains. The diagram show that a routing decision occurs before the 
OUTPUT chains, but a rerouting may occur because of a mark or 
destination NAT.