Re: iptables MARK + ip rule fwmark on locally generated packets

[Patrick McHardy <kaber@trash.net>]

Fredrik Ax wrote:
> Hi guys,
> 
> I'm a pretty experienced Linux / network developer and administrator,
> but I can't get my head around this one.
> 
> The long story is that I have a box used as router/fw/proxy running
> Debian Squeeze with a customized 2.6.32 x86_64 kernel having three
> interfaces (eth2,eth3,eth4) on the same external subnet. One of the
> interfaces is used for doing masquerading of other
> subnets. Masquerading (not snat) is chosen because the interfaces are
> on dhcp, and I don't want to have to rewrite the fw rules each time I
> get a new addr ... already have enough with dhclient-hooks for fixing
> the routing tables dns-updates, etc ;-) What I basically want to do is
> make the proxy's request to go out the same ifc as the masqueraded
> packets getting a src addr of s41.s42.s43.s44. Other locally generated
> packets should get a src addr s21.s22.s23.s24.
> 
> To accomplish this I'm using iptables to mark all, to port 80, locally
> generated tcp packets:
> 
> % iptables -t mangle -vnL OUTPUT
> Chain OUTPUT (policy ACCEPT 3234 packets, 2254K bytes)
>  pkts bytes target     prot opt in     out     source               destination         
>  1114  181K MARK       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 MARK set 0x4 
> 
> I have verified that the iptables rule marks them fine enough.
> 
> Then the ip rule with prio 99 below should then catch them and route
> according to table eth4 below. That rule however does, for some reason
> not match those packets, instead they are routed according to table
> eth2 below (prio 200 rule), getting src addr s21.s22.s23.s24.  If I
> disable that rule they are routed according the the prio 300 rule
> (getting src addr s31.s32.s33.s34).
> 
> ...
> 
> 
> What am I doing wrong here?

Source address selection happens before the packet is even generated,
so iptables marking in OUTPUT can't affect it.