Hi, CentOS release 5.5 (Final) 2.6.18-194.32.1.el5 #1 SMP Wed Jan 5 17:53:09 EST 2011 i686 i686 i386 GNU/Linux # ip route list table link1 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 192.168.19.0/24 dev eth0 proto kernel scope link src 192.168.19.2 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 default via 201.26.37.1 dev eth2 # ip route list table link2 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 192.168.19.0/24 dev eth0 proto kernel scope link src 192.168.19.2 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 default via 200.174.194.41 dev eth3 I've a script that copy the routes from main table to the link`s table. This is a trick I have heard in order to keep route up an running for everywhere.... Cheers, Davi 2011/1/25 Eric Dumazet <eric.dumazet@xxxxxxxxx>: > Le mardi 25 janvier 2011 à 17:19 -0200, Davi Baldin Tavares a écrit : >> Hello List, >> >> I have two NICs (eth1 and eth2) on my box, each one connected over a >> different ISP and both are configured in loadbalance (nexthop bla >> bla). >> >> I'm unable to use a specific interface by marking packets with >> iptables MARK/CONNMARK regardless the load-balancing on the box. I >> would like to set up for example all SMTP traffic (locally generated >> or not) going out only by the eth2, however, I can't see this working >> out. >> >> My setup is: >> >> # iptables -t mangle -L -n -v >> Chain PREROUTING (policy ACCEPT 753K packets, 356M bytes) >> pkts bytes target prot opt in out source destination >> 810 35766 CONNMARK all -- eth2 * 0.0.0.0/0 >> 0.0.0.0/0 state NEW CONNMARK set 0x81 >> 19 2810 CONNMARK all -- eth3 * 0.0.0.0/0 >> 0.0.0.0/0 state NEW CONNMARK set 0x82 >> 7657 670K CONNMARK all -- * * 0.0.0.0/0 >> 0.0.0.0/0 CONNMARK restore >> >> Chain OUTPUT (policy ACCEPT 381K packets, 185M bytes) >> pkts bytes target prot opt in out source destination >> 32 2099 CONNMARK tcp -- * * 0.0.0.0/0 >> 0.0.0.0/0 tcp dpt:25 CONNMARK set 0x82 >> 32 2099 MARK tcp -- * * 0.0.0.0/0 >> 0.0.0.0/0 tcp dpt:25 MARK set 0x82 >> >> (As you can see, packages are being marked). >> >> # ip rule list >> 0: from all lookup 255 >> 3: from all fwmark 0x82 lookup link2 >> 3: from all fwmark 0x81 lookup link1 > > same rule numbers 3 and 3 ?? >> 10: from 200.174.194.44 lookup link2 >> 10: from 201.26.37.40 lookup link1 > > ditto > >> 32766: from all lookup main >> 32767: from all lookup default >> >> # ip route list >> 200.174.194.40/29 dev eth3 proto kernel scope link src 200.174.194.44 >> 201.26.37.0/24 dev eth2 proto kernel scope link src 201.26.37.40 >> default >> nexthop via 200.174.194.41 dev eth3 weight 1 >> nexthop via 201.26.37.1 dev eth2 weight 3 >> >> At this point the mark 0x82 is related to the link on the eth3 (net >> 200.174.194.41). However, using this setup, the outgoing packets >> almost always came from eth2 (which has a bigger weight on the >> balance). I believe the balance is working (and acting on this case) >> and the mark and route from a specific interface is not. >> >> Do you happen to know something that could give me some light or >> directions on order to put this working fine? > > Hello > > What is your kernel version ? > > ip route list table link2 > ip route list table link1 > > > > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
