Jan Engelhardt wrote:
On Wednesday 2008-05-07 16:36, pthyseba@xxxxxxxxxxxxxx wrote:
This setup works as expected: the targeted packets are routed to the
different gateway. However, my question is: why does this work?
Because we expect it to :)
After studying the iptables block diagrams, it seems that the packet
travels through the OUTPUT chains AFTER "routing". I assumed that
"routing" implied the lookup of the correct routing table and then
selection of the correct rule in that table, but putting the iptables and
my definition of "routing" together, it would seem that packets only get
marked (the MARK target is in the output chain) after "routing" has been
done (and I assumed filtering packets using the fwmark filter was done in
that step). Obviously, I'm misunderstanding something, as packets that get
marked in the OUTPUT chain do get routed correctly (meaning, have their
mark set when routing is looking for the correct routing table).
Correct, there is an extra reroute done in the output path
(see http://jengelh.medozas.de/images/nf-packet-flow.png )
Jan, could you explain please which code does this extra rerouting:
iproute2 or netfilter? I have a weird with the same scenario: after
rerouting a packet goes out through another interface but keeps the
source address of the original interface.
--
Alexei
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
