Le mardi 25 janvier 2011 Ã 17:19 -0200, Davi Baldin Tavares a Ãcrit : > Hello List, > > I have two NICs (eth1 and eth2) on my box, each one connected over a > different ISP and both are configured in loadbalance (nexthop bla > bla). > > I'm unable to use a specific interface by marking packets with > iptables MARK/CONNMARK regardless the load-balancing on the box. I > would like to set up for example all SMTP traffic (locally generated > or not) going out only by the eth2, however, I can't see this working > out. > > My setup is: > > # iptables -t mangle -L -n -v > Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes) > pkts bytes target prot opt in out source destination > 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0 > 0.0.0.0/0 state NEW CONNMARK set 0x81 > 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0 > 0.0.0.0/0 state NEW CONNMARK set 0x82 > 7657 670K CONNMARK all -- * * 0.0.0.0/0 > 0.0.0.0/0 CONNMARK restore > > Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes) > pkts bytes target prot opt in out source destination > 32 2099 CONNMARK tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82 > 32 2099 MARK tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:25 MARK set 0x82 > > (As you can see, packages are being marked). > > # ip rule list > 0: from all lookup 255 > 3: from all fwmark 0x82 lookup link2 > 3: from all fwmark 0x81 lookup link1 same rule numbers 3 and 3 ?? > 10: from 200.174.194.44 lookup link2 > 10: from 201.26.37.40 lookup link1 ditto > 32766: from all lookup main > 32767: from all lookup default > > # ip route list > 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 > 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 > default > nexthop via 200.174.194.41 dev eth3 weight 1 > nexthop via 201.26.37.1 dev eth2 weight 3 > > At this point the mark 0x82 is related to the link on the eth3 (net > 200.174.194.41). However, using this setup, the outgoing packets > almost always came from eth2 (which has a bigger weight on the > balance). I believe the balance is working (and acting on this case) > and the mark and route from a specific interface is not. > > Do you happen to know something that could give me some light or > directions on order to put this working fine? Hello What is your kernel version ? ip route list table link2 ip route list table link1 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
