Hi, i think that exist another way to do this (best). The linux kernel will select the routing tables according to the RPDB rules. You "cant" define a default gw into main table (for best routing treatment). But, you can change your RPDB to select a default gw out of main table (forced). For example: ip route del default ip rule flush ip rule add prio 10 table main ip rule add prio 50 fwmark 101 table 101 ip rule add prio 51 fwmark 103 table 103 ip rule add prio 100 table 101 ip route flush cache Another thing is... the mangle table is processed per packet. So, i think you shouldnt use the NEW state to validate the netfilter marks. Your netfilter MARKs shall be made with --set-mark 0x101 or 0x103 2012/3/28 John Lister <john.lister@xxxxxxxxxxxxxxx>: > Hi, I've got a multi homed system which was all working fine until it was > accidentally rebooted a couple of days ago and this is probably more LARTC > but that list seems dead? > > Anyway I'm now seeing bizarre behaviour running ubuntu 10.04 kernel > 2.6.32-40. Previously I would mark the packets in prerouting and then have > fwmark based rules in the routing table to send them out via a separate > custom routing table. I have the main routing table set up with a default > route via one of the interfaces > > Now I can see when debugging iptables, that the interface is set correctly > and the packet is marked, but sticking a sniffer onto the interfaces shows > me that the packets are coming out of the default interface. If i disable > the default route I get "unreachable host". Another wierd thing is that > conntrack is showing separate new connections as established, for example if > I ping 1 packet and repeat the command the second ping is labelled as > established which I wouldn't expect... (I've posted this issue earlier as > restore-mark is working for what I'd expect to be new connections) > > Anyway my setup > interfaces > eth0 : 192.168.2.7 > eth1 : x.37.63.74 gw=x.37.63.73 > eth3 : x.45.115.81 gw=x.45.115.86 > > # add extra routing tables > ip route add x.37.63.72/29 dev eth1 table 101 > ip route add 192.168.2.0/24 dev eth0 table 101 > ip route add default via x.37.63.73 dev eth1 table 101 > > ip route add x.45.115.80/29 dev eth3 table 103 > ip route add 192.168.2.0/24 dev eth0 table 103 > ip route add default via x.45.115.86 dev eth3 table 103 > > # add rules > ip rule add fwmark 101 table 101 > ip rule add fwmark 103 table 103 > > # route a specific ip out for testing sent from 192.168.2.x and forwarded > through this box. > iptables -t mangle -A PREROUTING -d 98.207.221.49/32 -m state --state NEW -j > MATCH1 > iptables -t mangle -A MATCH1 -j MARK --set-mark 0x1 > iptables -t mangle -A MATCH1 -j CONNMARK --save-mark > > iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to x.37.63.74 > > > The above is a simplified subset but covers the basics I think. Anyway doing > ping 98.207.221.49 > from an internal machine using this as its gateway fails. I can see it marks > the rule, does the routing which sets the outgoing interface correctly but > then the packet comes out of the default interface and is then lost. The > following logs are generated (cropped for readability) from which you can > see it getting marked and the interface set correctly > > PREROUTING (NEW) IN=eth0 OUT= SRC=192.168.2.133 DST=98.207.221.49 LEN=60 > TOS=0x00 PREC=0x00 TTL=128 ID=9452 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1354 > PREROUTING (MARK1) IN=eth0 OUT= SRC=192.168.2.133 DST=98.207.221.49 LEN=60 > TOS=0x00 PREC=0x00 TTL=128 ID=9452 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1354 > FORWARD IN=eth0 OUT=eth1 SRC=192.168.2.133 DST=98.207.221.49 LEN=60 TOS=0x00 > PREC=0x00 TTL=127 ID=9452 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1354 MARK=0x1 > POSTROUTING IN= OUT=eth1 SRC=192.168.2.133 DST=98.207.221.49 LEN=60 TOS=0x00 > PREC=0x00 TTL=127 ID=9452 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1354 MARK=0x1 > SNATTING IN= OUT=eth1 SRC=192.168.2.133 DST=98.207.221.49 LEN=60 TOS=0x00 > PREC=0x00 TTL=127 ID=9452 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1354 MARK=0x1 > > anyone got an idea what is going on? > > Thanks > > John -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
