[LARTC] Re: Pb routing/fwmark

[Frédéric Massot]

Frédéric Massot wrote:
> Hi,
> 
> I have a computer which is used as router/firewall/VPN with four network 
> card. One connected on the LAN (br0, 10.0.0.0/24), the three others to 
> three different ISP, eth0 192.168.1.0/29, eth1 192.168.0.0/24, eth2 
> 192.168.2.0/29.
> 
> This computer is under Linux 2.6.11 with the Julian Anastasov routes patch.
> 
> The configuration by default is to balance the load on the three 
> interfaces.
> 
> Then, I must route certain service to certain interfaces :
> 
> - LAN to Internet 3389/TCP --> eth2
> - Router to Internet 25/TCP --> eth2
> - LAN to Internet 80/TCP --> eth1
> 
> I have this routing policy :
> 
> $ ip rule
> 0:      from all lookup local
> 50:     from all lookup main
> 101:    from all fwmark 0xd3d lookup 203
> 103:    from all fwmark 0x19 lookup 203
> 104:    from all fwmark 0x50 lookup 202
> 201:    from 192.168.1.0/29 lookup 201
> 202:    from 192.168.0.0/24 lookup 202
> 203:    from 192.168.2.0/29 lookup 203
> 222:    from all lookup 222
> 32766:  from all lookup main
> 32767:  from all lookup default
> 
> $ ip route list table main
> 193.253.176.56 dev eth0  scope link
> 81.56.255.222 dev eth1  scope link
> 195.6.84.110 dev eth2  scope link
> 192.168.2.0/29 dev eth2  proto kernel  scope link  src 192.168.2.1
> 192.168.1.0/29 dev eth0  proto kernel  scope link  src 192.168.1.1
> 192.168.254.0/26 dev eth0  scope link
> 10.0.0.0/24 dev br0  proto kernel  scope link  src 10.0.0.3
> 192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.1
> 
> $ ip route list table 201
> default via 192.168.1.6 dev eth0  proto static  src 192.168.1.1
> prohibit default  proto static  metric 1
> 
> $ ip route list table 202
> default via 192.168.0.6 dev eth1  proto static  src 192.168.0.1
> prohibit default  proto static  metric 1
> 
> $ ip route list table 203
> default via 192.168.2.6 dev eth2  proto static  src 192.168.2.1
> prohibit default  proto static  metric 1
> 
> $ ip route list table 222
> default  proto static
>         nexthop via 192.168.1.6  dev eth0 weight 1
>         nexthop via 192.168.0.6  dev eth1 weight 4
>         nexthop via 192.168.2.6  dev eth2 weight 4
> 
> 
> And, I mark the paquet with this rule :
> 
> iptables -t mangle -A PREROUTING -p tcp --dport 3389 -j MARK --set-mark 
> 3389
> iptables -t mangle -A PREROUTING -p tcp --dport 25 -j MARK --set-mark 25
> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 80
> 
> 
> 
> My problem, is that the HTTP is to route to all the interfaces, the SMTP 
> seems to be route to the good interface (eth2), and the TSE (3389) is 
> route to all the interfaces.
> 
> I do not understand which is the problem, can you help me ?
> 

Hi,

In my preceding example, I had enabled the connection tracking:

iptables -t mangle -A PREROUTING -m state --state ESTABLISHED,RELATED -j 
ACCEPT
iptables -t mangle -A POSTROUTING -m state --state ESTABLISHED,RELATED 
-j ACCEPT
iptables -t mangle -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t mangle -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t mangle -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

And, I mark the paquet with this rule :

iptables -t mangle -A PREROUTING -p tcp --dport 3389 -j MARK --set-mark
  3389
iptables -t mangle -A PREROUTING -p tcp --dport 25 -j MARK --set-mark 25
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 80

That did not run ! :(

I disabled the connexion tracking and I modified the rules like this, 
and that seems to run :

iptables -t mangle -A FORWARD -o eth0 -p tcp --dport 3389 -j MARK 
--set-mark 3389
iptables -t mangle -A FORWARD -o eth1 -p tcp --dport 3389 -j MARK 
--set-mark 3389
iptables -t mangle -A FORWARD -o eth2 -p tcp --dport 3389 -j MARK 
--set-mark 3389

iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 3389 -j MARK 
--set-mark 3389
iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 3389 -j MARK 
--set-mark 3389
iptables -t mangle -A OUTPUT -o eth2 -p tcp --dport 3389 -j MARK 
--set-mark 3389

iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 3389 -j MARK 
--set-mark 3389

iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 25 -j MARK --set-mark 25
iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 25 -j MARK --set-mark 25
iptables -t mangle -A OUTPUT -o eth2 -p tcp --dport 25 -j MARK --set-mark 25

iptables -t mangle -A FORWARD -o eth0 -p tcp --dport 80 -j MARK 
--set-mark 80
iptables -t mangle -A FORWARD -o eth1 -p tcp --dport 80 -j MARK 
--set-mark 80
iptables -t mangle -A FORWARD -o eth2 -p tcp --dport 80 -j MARK 
--set-mark 80

iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 80 -j MARK --set-mark 80
iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 80 -j MARK --set-mark 80
iptables -t mangle -A OUTPUT -o eth2 -p tcp --dport 80 -j MARK --set-mark 80

iptables -t mangle -A PREROUTING -i br0 -p tcp --dport 80 -j MARK 
--set-mark 80


Can you say to me if it is the good method?

I am astonished to mark the packets on the three output interface.

Regards.
-- 
==============================================
|              FREDERIC MASSOT               |
|     http://www.juliana-multimedia.com      |
|   mailto:frederic at juliana-multimedia.com   |
===========================Debian=GNU/Linux===