It did't work becasue the packet is trying to go out on the secondary interface using the address of the primary interface, so the packet get dropped by the ISP. Well, the MARK on the OUTPUT mangle worked well actually, deviating the traffic, just creating the source address problem. Am I forgetting something? Thanks. -----Original Message----- From: lartc-admin@xxxxxxxxxxxxxxx [mailto:lartc-admin@xxxxxxxxxxxxxxx] On Behalf Of Esteban Ribicic Sent: Wednesday, March 05, 2003 1:00 PM To: Stephane Ouellette Cc: Esteban Ribicic; Alessandro Ren; LARTC Subject: Re: [LARTC] ip rule and transparent proxy. after marking the packet, it is posible to route over ip (marking in output)...packet goes to the gw you choose..routeing after is other issue, as you cant know or predict what will do your isp router. the packet will go where you told him to go (through fwmarks) with src address as kernel algorithm says so (probably, if not bind() called, the ip address of the interface on wich the default gw is setted).. if the src address of the packet does not match with the interface you choose, is probably that the packet leaves the interface and never come back -my scpecial case, is that my two links are from the same isp and they route the packet trgout a default route in their router- ..so packets leaves from one interface and comes in the other... but, you can (i hvent tryed this, but i think it should work) nat the src adress and packet will go and come....maybe you shlud nat the packet again when it comes... example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for example.. i have working hwat i said on my linux box for squid packets..the go from one interface and come in the other. steve On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote: > Esteban Ribicic wrote: > > >you should try marking squid packets (output chain for example) and > >then add a rule (ip rule ls).. in lartc.org > >http://www.lartc.org/lartc.pdf have plenty of examples. > > > > > > Unfortunately, this will not work. It is not possible to route a > locally-generated packet using a firewall mark because the routing > decision is taken before the packet is sent to the MANGLE OUTPUT chain. > Routing a packet using a firewall mark works only in the PREROUTING > Netfilter hook. > > Stephane Ouellette > > >tips: when marking packets on iptables, use hexa not decimal notting. > >try patching the kernel if does not work (http://www.ssi.bg/~ja/) > >cause kernel default source may not work... > > > >and its probably that squid use as source adrres of ip header the ip > >on the default route, so you might have to nat that src to the other > >interface (so packets leave the interface you want and come back in > >that interface and not the other -if they come..- ) > > > >greets and good speed. > > > >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote: > > > > > _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
