yeah, try natting the packet on the rule so src addreess will chanche. that might work. or try looking on squids patches or docu if you can specify anything on it. greets On Thu, 2003-03-06 at 11:18, Alessandro Ren wrote: > > It did't work becasue the packet is trying to go out on the > secondary interface using the address of the primary interface, so the > packet get dropped by the ISP. > Well, the MARK on the OUTPUT mangle worked well actually, deviating > the traffic, just creating the source address problem. > > Am I forgetting something? > > Thanks. > > -----Original Message----- > From: lartc-admin@xxxxxxxxxxxxxxx [mailto:lartc-admin@xxxxxxxxxxxxxxx] On > Behalf Of Esteban Ribicic > Sent: Wednesday, March 05, 2003 1:00 PM > To: Stephane Ouellette > Cc: Esteban Ribicic; Alessandro Ren; LARTC > Subject: Re: [LARTC] ip rule and transparent proxy. > > > after marking the packet, it is posible to route over ip (marking in > output)...packet goes to the gw you choose..routeing after is other issue, > as you cant know or predict what will do your isp router. > > the packet will go where you told him to go (through fwmarks) with src > address as kernel algorithm says so (probably, if not bind() called, the ip > address of the interface on wich the default gw is setted).. > > if the src address of the packet does not match with the interface you > choose, is probably that the packet leaves the interface and never come back > -my scpecial case, is that my two links are from the same isp and they route > the packet trgout a default route in their router- ..so packets leaves from > one interface and comes in the other... but, you can (i hvent tryed this, > but i think it should work) nat the src adress and packet will go and > come....maybe you shlud nat the packet again when it comes... > example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for > example.. > > i have working hwat i said on my linux box for squid packets..the go from > one interface and come in the other. > > steve > > On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote: > > Esteban Ribicic wrote: > > > > >you should try marking squid packets (output chain for example) and > > >then add a rule (ip rule ls).. in lartc.org > > >http://www.lartc.org/lartc.pdf have plenty of examples. > > > > > > > > > > Unfortunately, this will not work. It is not possible to route a > > locally-generated packet using a firewall mark because the routing > > decision is taken before the packet is sent to the MANGLE OUTPUT chain. > > Routing a packet using a firewall mark works only in the PREROUTING > > Netfilter hook. > > > > Stephane Ouellette > > > > >tips: when marking packets on iptables, use hexa not decimal notting. > > >try patching the kernel if does not work (http://www.ssi.bg/~ja/) > > >cause kernel default source may not work... > > > > > >and its probably that squid use as source adrres of ip header the ip > > >on the default route, so you might have to nat that src to the other > > >interface (so packets leave the interface you want and come back in > > >that interface and not the other -if they come..- ) > > > > > >greets and good speed. > > > > > >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote: > > > > > > > > > > _______________________________________________ > LARTC mailing list / LARTC@xxxxxxxxxxxxxxx > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/ > > -- Esteban Ribicic Network Operation Center UOL-Sinectis S.A. Florida 537 Piso 6, Buenos Aires, Argentina +54-11-4321-9110 Ext 2503 +54-11-4321-9107 Directo eribicic@xxxxxxxxxxxxxxx www.uolsinectis.com
