Hi all,
In my network routing based on MARK do not work. Return packets (SYN -
ACK) do not reach client.
My network :
local area -------
|
|--------------eth0 server eth1 --------------
provider 1
|
external N------
I want to assure access to "external N " from "local area"
I prepared new routing table :
ip rule add fwmark 5 table EXTERNAL
ip route add default via $EXTERNAL_NETWORK_GW_IP dev eth0 table EXTERNAL
next iptable rules:
iptables -t nat PREROUTING -t mangle -i eth0 [DST PORT/ADDRESSES RULES]
-j MARK --set-mark 5
to disable NAT and redirection to proxy:
iptables -t nat PREROUTING -m mark --mark 5 -j ACCPET
iptables -t nat POSTROUTING -m mark --mark 5 -j ACCPET
tcpdump on "server" shows:
"local area IP " > "external N IP" SYNC
"local area IP" > "external N IP" SYNC
"external N IP" > "local area IP " SYNC ACK
last packet appears only once - that packet to not each host in local area
accept_reidirection and send_reisrections are disabled
What is wrong ?
Thanks for any suggestions.
Pawel
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
