CONNMARK udp comprehension question

Hi List

Have a question in order to understand if i am tilting at windmills or if there's an issue with my setup.

Here a short description of my scenario to help me to explain myself:

I have a box with multiple uplinks running openvpn in udp mode. One of the uplinks has the default gateway (no multipath route). Now, whenever i connect to an uplink which actually hasn't the default gateway, packets go in through that device and exit through another (due to the default gateway), which will break the udp-"connection".

Now, the question:
I mark all connections entering a specific uplink with a number using CONNMARK, in order to be able to distinguish them and make them leave the correct interface using fwmark based ip rules.

Shouldn't now the CONNMARK target, mark the connection in such a manner that the udp packets coming in have the same mark as the udp packets going out whenever they belong to the same "connection"?
Or is this just not possible due to the connection-less nature of udp?

Same setup works for me with tcp and it also works with udp when the connections going through the box (FORWARD).

Kernel is RH'L5.1's kernel-2.6.18-53 with all relevant options enabled and iptables 1.3.8.

Any help would be greatly appreciated!

peter

:: e n d i a n
:: open source - open minds

:: peter warasin
:: http://www.endian.com   :: [email protected]

begin:vcard
fn:Peter Warasin
n:;Peter Warasin
org:Endian GmbH/Srl
adr:;;Pillhof 47;Frangart/Frangarto;BZ;I-39010;Italien/Italia email;internet:[email protected]
tel;work:+39 0471 631763
tel;fax:+39 0471 631764
x-mozilla-html:FALSE
url:http://www.endian.com
version:2.1
end:vcard

You have to restore the mark in your ruleset. Also, UDP has quite a short timeout, so the new packet may not belong to the connection anymore,

HTH,
M4

This might help you without the need to mess with marks.

For each uplink interface with an incremental $x

ip route add default via $gateway_ip dev $uplink_interface table $x ip rule add from $ip_of_interface dev $uplink_interface table $x

alternatively use -j CONNMARK --restore-mark in -t mangle PREROUTING so that ip rules can match the mark or as a 3rd option use the ROUTE target.

- Jörg

Hi Jörg

Thanks for your answer. Much appreciated!

Actually i have it already like you mentioned:

----------------------------
ip rule add from 192.168.75.0/24 lookup uplink-uplink1 ip route add default via 192.168.75.1 table uplink-uplink1

ip rule add from 192.168.69.0/24 lookup uplink-main ip route add default via 192.168.69.1 table uplink-main
----------------------------

this should be ok for connections starting from the box, but seems that is not for udp connections.

this works for connections passing through the box and also for tcp connections
going to the box.

----------------------------
ip rule add prio 200 fwmark 0x20 lookup uplink-uplink1 ip rule add prio 200 fwmark 0x40 lookup uplink-main

-A PREROUTING -j INMARK -m state --state NEW
-A PREROUTING -j STOREMARK -m state ! --state NEW
-A INPUT -j INMARK -m state --state NEW
-A OUTPUT -j STOREMARK -m state ! --state NEW

-A INMARK -i eth3 -j CONNMARK --set-mark 0x20
-A INMARK -i eth4 -j CONNMARK --set-mark 0x40

-A STOREMARK -m connmark ! --mark 0x0 -j CONNMARK --restore-mark
----------------------------

but not for udp.

should'nt this work?

if i put in ulog rules i see that udp packets certainly will be marked when coming in but don't have a mark when will going out.

just to know that i am not completely wrong.

peter

:: e n d i a n
:: open source - open minds

:: peter warasin
:: http://www.endian.com   :: [email protected]

begin:vcard
fn:Peter Warasin
n:;Peter Warasin
org:Endian GmbH/Srl
adr:;;Pillhof 47;Frangart/Frangarto;BZ;I-39010;Italien/Italia email;internet:[email protected]
tel;work:+39 0471 631763
tel;fax:+39 0471 631764
x-mozilla-html:FALSE
url:http://www.endian.com
version:2.1
end:vcard