Re: fwmark iptables/ip routing interaction question

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Alexei Ustyuzhaninov a écrit :
>>
>>> I have a weird with the same scenario: after rerouting a packet goes
>>> out through another interface but keeps the source address of the 
>>> original interface.
>>
>> Yes that is ... how the code is currently written it seems.

The source address is chosen before the packet is sent to the OUTPUT 
chains, and cannot be changed by the rerouting code, this would break 
things such as connection tracking. It requires stateful NAT so the 
correct original address is put back in replies. By the way, DNAT in the 
OUTPUT chain used to implicitly change the source address when the new 
destination address caused the output interface to change until kernel 
2.6.11.

> Well, maybe you can suggest how to work around this? :) I tried snat, 
> but this solution seems not to work.

SNAT should work on packets creating a new connection (i.e. in the state 
NEW).