Re: Selectively routing packets through different links

[David Favro <netfilter@meta-dynamic.com>]

John Lister wrote:
> I suspect you need to save the mark in the conntrack table so that it 
> is applied to every related packet - I've got a similar configuration 
> except I route out of multiple interfaces depending upon load and took 
> a while to get working reliably.
You shouldn't need to use CONNMARK because all of the outbound packets 
will have the same destination port and thus get marked by MARK, and the 
inbound packets don't typically need to get marked for a special routing 
table; however it might be a good idea to use CONNMARK anyhow, it may 
help with reverse-path filtering -- but alternatively, I would recommend 
turning RPF off anyhow:
echo "2" > /proc/sys/net/ipv4/conf/bnep0/rp_filter
Also,
echo "1" > /proc/sys/net/ipv4/conf/bnep0/log_martians
You can then check your kernel log to see if reverse-path filtering is 
causing you problems, which is a good possibility.  If you see martian 
packets in your log after setting rp_filter for the interface to 2 per 
above (but you shouldn't), then you could RPF entirely:
echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/bnep0/rp_filter
... but I don't think that should be needed.

Also check your filter rules in iptables, are you explicitly dropping 
the packets?

> Diego Lima wrote:
>> 1 - Edit /etc/iproute2/rt_tables and add this:
>> 10 bluez
>>
>> 2 - Add the route and rule:
>> # ip route add via 192.168.21.1 dev bnep0 table bluez
>> # ip rule add fwmark 10 lookup bluez
>>
>> 3 - Add the iptables rules:
>> iptables -t mangle -I PREROUTING -i wlan0 -s 192.168.0.0/24 -p tcp -m
>> multiport --dports 80,443,8080 -j MARK --set-mark 10
>> iptables -t nat -I POSTROUTING ! -o lo -j MASQUERADE
Your masquerading looks to me to be overly aggressive, why masquerade 
packets going out to wlan0?
iptables -t nat -A POSTROUTING -o bnep0 -j MASQUERADE

If you have externally-originated incoming connections on bnep0 (I guess 
not, your message sounds like all of your traffic on bnep0 is 
connections that are originating from the LAN) -- but if so, you need 
more routing rules or iptables fwmark to make sure than inbound 
connections from bnep0 go back out through bnep0.

Hope that helps,
-- David