Skip to contentSkip to conversation

routing based on MARK problem

DISCUSSION Pawel 1 participant 1 message Oct 9, 2007

lore
Share & tools
lore

Pawel

author
#0 lore raw

Hi all,

In my network routing based on MARK do not work. Return packets (SYN - ACK) do not reach client.

My network :

local area -------

                        |
                        |--------------eth0 server eth1 -------------- 
provider 1
                        |

external N------ I want to assure access to "external N " from "local area" I prepared new routing table :

ip rule add fwmark 5 table EXTERNAL
ip route add default via $EXTERNAL_NETWORK_GW_IP dev eth0 table EXTERNAL

next iptable rules:

iptables -t nat PREROUTING -t mangle -i eth0 [DST PORT/ADDRESSES RULES] -j MARK --set-mark 5 to disable NAT and redirection to proxy:

iptables -t nat PREROUTING -m mark --mark 5 -j ACCPET iptables -t nat POSTROUTING -m mark --mark 5 -j ACCPET

tcpdump on "server" shows:
"local area IP " > "external N IP" SYNC
"local area IP" > "external N IP" SYNC
"external N IP" > "local area IP " SYNC ACK

last packet appears only once - that packet to not each host in local area

accept_reidirection and send_reisrections are disabled

What is wrong ?
Thanks for any suggestions.

Pawel