Hello List, I have two NICs (eth1 and eth2) on my box, each one connected over a different ISP and both are configured in loadbalance (nexthop bla bla). I'm unable to use a specific interface by marking packets with iptables MARK/CONNMARK regardless the load-balancing on the box. I would like to set up for example all SMTP traffic (locally generated or not) going out only by the eth2, however, I can't see this working out. My setup is: # iptables -t mangle -L -n -v Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes) pkts bytes target prot opt in out source destination 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW CONNMARK set 0x81 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0 0.0.0.0/0 state NEW CONNMARK set 0x82 7657 670K CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes) pkts bytes target prot opt in out source destination 32 2099 CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82 32 2099 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 MARK set 0x82 (As you can see, packages are being marked). # ip rule list 0: from all lookup 255 3: from all fwmark 0x82 lookup link2 3: from all fwmark 0x81 lookup link1 10: from 200.174.194.44 lookup link2 10: from 201.26.37.40 lookup link1 32766: from all lookup main 32767: from all lookup default # ip route list 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 default nexthop via 200.174.194.41 dev eth3 weight 1 nexthop via 201.26.37.1 dev eth2 weight 3 At this point the mark 0x82 is related to the link on the eth3 (net 200.174.194.41). However, using this setup, the outgoing packets almost always came from eth2 (which has a bigger weight on the balance). I believe the balance is working (and acting on this case) and the mark and route from a specific interface is not. Do you happen to know something that could give me some light or directions on order to put this working fine? Cheers, Davi -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
