[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: ip route fwmark with iptables -set--mark

Le jeudi 04 décembre 2003 à 18h27 (+0800), kaiwen écrivait :
>    Routing Table:
>    [root@son-ag webauth]# ip route show table main
> dev eth0  scope link
> dev lo  scope link
>    default via dev eth0

Do you realy want to not have a route for network

>    [root@son-ag webauth]# ip route show table test
> dev br0  scope link
>    default via dev eth0

Do you realy want to not have a route for network

Also, take care of using bridge (br0) since iptables doesn't apply on it
without a kernel patch AFAIK.

>    32765:  from all fwmark        d lookup test


>    [root@son-ag webauth]# iptables -t mangle -L
>    Chain PREROUTING (policy ACCEPT)
>    target     prot opt source               destination
>    MARK       all  --  anywhere             anywhere           MARK set 0x13

Take care that "anywere to anywere" means it applies for the return of
replies (ICMP echo-reply) to request (ICMP echo-request) too...

>    Ping from Client to Router eth1, Ping FAILED.
>    I think I am missing something in the configuration.
>    I tried setting
>    > ip rule add from table test
>    Ping is SUCCESS in this case.

Probably because it uses table test for the ICMP echo-request, but
not for the ICMP echo-reply coming back... So you may need to be more
precise on your iptable mangle rule by specifying source addresses.

Also, "tcpdump" is your friend to look for problem symptoms.
(use something like "tcpdump -lni any icmp")

J.C. "プログフ" ANDRÉ <jean-christophe.andre@auf.org> http://www.vn.refer.org/
Coordonnateur technique régional / Associé technologie projet Reflets (CODA)
Agence universitaire de la Francophonie (AuF) / Bureau Asie-Pacifique (BAP)
Adresse postale : AUF, 21 Lê Thánh Tông, T.T. Hoàn Kiếm, Hà Nội, Việt Nam
Tél. : +84 4 9331108   Fax : +84 4 8247383   Mobile : +84 91 3248747
⎧ Note personnelle : merci d'éviter de m'envoyer des fichiers PowerPoint   ⎫
⎩ ou Word ; voir http://www.fsf.org/philosophy/no-word-attachments.fr.html

Reply to: