Re: CONFIG_IP_ROUTE_FWMARK not working in Debian !

From: Nelson Castillo (nelsoneci_at_gmail.com)
Date: 10/10/05

  • Next message: Carl Fink: "Re: Should users have to manually modprobe to use standard peripherals?" 
    Date: Sun, 9 Oct 2005 19:12:44 -0500
To: supermega <tomek@heh.pl>

    > # iptables -t mangle -A PREROUTING -s <LAN_IP> -j MARK --set-mark 5

    I guess you should use the conntrack module. I'm not sure,
    but I think you're marking only the first packet of the
    connection.

    I have something like this to mark them (different scenario... a load balancer
    with 2 uplink providers):

    iptables -t mangle -A PREROUTING -m conntrack --ctorigdst $IP1 \
       -p tcp -m tcp --dport 110 -j MARK --set-mark 1

    > and I route them via ISP2
    > # ip rule add fwmark 5 table isp2
    > Does anyone have CONFIG_IP_ROUTE_FWMARK working in debian?

    I do.

    "ip rule add fwmark 1 table T1" works for me. Default sarge kernel. 

    --
Homepage : http://geocities.com/arhuaco
The first principle is that you must not fool yourself
and you are the easiest person to fool.
     -- Richard Feynman.
  • Next message: Carl Fink: "Re: Should users have to manually modprobe to use standard peripherals?"

    Relevant Pages

    • Re: CONFIG_IP_ROUTE_FWMARK not working in Debian !
      ... >> I guess you should use the conntrack module. ... >> but I think you're marking only the first packet of the ... What does mangling packets have to do with connection tracking? ... The first principle is that you must not fool yourself ...
      (Debian-User)
    • Re: Solaris slow in rejecting connections to idle ports
      ... > According to tcpdump, Solaris does not always reply to the first packet ... > trying to open the connection. ...
      (comp.unix.solaris)
    • Re: Client doesnt drop failed source
      ... keep alives if there is no natural traffic in one direction. ... the first packet towards the side that has forgotten the connection will ... (and/or kill the oldest one if you have too many) ...
      (comp.protocols.time.ntp)
    • Another Iptables Filtering Rules Question
      ... > A) That first rule will allow the first packet in the TCP connection ... any way to peek at an incomming connection, and tell the system to toss it ... is there any way to delay any responce (faking the connection to ...
      (comp.os.linux.security)
    • Re: Iptables problem
      ... :On Tue, 4 Oct 2005, Robert Nichols wrote: ... :> You are aware that only the first packet of a connection is processed in ... :> was taken on the first packet, but wont be seen by any rule in the nat ...
      (comp.os.linux.security)