Re: fwmark iptables/ip routing interaction question

[Alexei Ustyuzhaninov <alust@alust.homeunix.com>]

Pascal Hambourg wrote:
> Hello,
> 
> Alexei Ustyuzhaninov a écrit :
>>>
>>>> I have a weird with the same scenario: after rerouting a packet goes
>>>> out through another interface but keeps the source address of the 
>>>> original interface.
>>>
>>> Yes that is ... how the code is currently written it seems.
> 
> The source address is chosen before the packet is sent to the OUTPUT 
> chains, and cannot be changed by the rerouting code, this would break 
> things such as connection tracking. It requires stateful NAT so the 
> correct original address is put back in replies. By the way, DNAT in the 
> OUTPUT chain used to implicitly change the source address when the new 
> destination address caused the output interface to change until kernel 
> 2.6.11.

Hm. That's not clear to me as I don't know the destination address in 
advance (and don't want to change it). Anyhow this solution is obsolete 
as I see.

>> Well, maybe you can suggest how to work around this? :) I tried snat, 
>> but this solution seems not to work.
> 
> SNAT should work on packets creating a new connection (i.e. in the state 
> NEW).

Yes, really! The SYN packet goes out through the right interface with 
the right source address, SYN/ACK comes back and that's all, nothing 
will happen more.

Anyhow  isn't this problem unresolvable in general? I just want a simple 
thing: to send mail via one provider and all other traffic via the other 
provider,

-- 
Thanks,
Alexei