Marks set in PREROUTING got lost
Hi everyone,
after experimenting with setting marks (--set-mark) in the PREROUTING chain in the mangle table, I found out, that those marks were not accessible/matchable in PREROUTING nat table. I was able to see the marks in chain FORWARD mangle table though :-(
Is this behavior supposed to be like that?
Thank you for your help!
Greets, Clemens
Quoted 3 lines
Hi everyone,
after experimenting with setting marks (--set-mark) in the
What marks, per-packet marks or per-connection marks?
Quoted 11 lines
PREROUTING chain in the mangle table, I found out, that those marks were not accessible/matchable in PREROUTING nat table. I was able to see the marks in chain FORWARD mangle table though :-(
Is this behavior supposed to be like that?
Thank you for your help!
Greets, Clemens
Jan Engelhardt
Quoted 4 lines
What marks, per-packet marks or per-connection marks?
I am not sure, how to distinguish, I just mark all pakets that pass through a certain user defined chain. I guess this is a mark per packet. The particular chain lookes like this:
Chain FWD_WWW-101 (2 references)
target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
100000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set 0x65
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
1000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set 0x1
The goal is to provide full network speed for all NATed computers for a certain amount of bytes (first quota match), then mark their packets individually (each computer has its own mangle chain (FWD_WWW-$computernumber)) with its computernumber in hex, so tc can slow down their connection to 56k and after the "slow quota" is used up, the users packets get a different mark (mark 1) and get a DNAT to an Over Quota webpage, when the user tries to access an outside webpage, other connectionattempts get droped.
The problem is now, that pakets get marked with the mark 0x1, but in PREROUTING nat table, this mark never appears.
Thanks, Clemens
Quoted 4 lines
Quoted 3 lines
What marks, per-packet marks or per-connection marks?
I am not sure, how to distinguish, I just mark all pakets that pass
-j MARK => per-packet
-j CONNMARK => per-connection
Quoted 7 lines
through a certain user defined chain. I guess this is a mark per packet. The particular chain lookes like this:
Chain FWD_WWW-101 (2 references)
target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
Quoted 7 lines
100000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x65
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
1000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x1
MARK is only allowed in the mangle table.
Quoted 12 lines
The goal is to provide full network speed for all NATed computers for a certain amount of bytes (first quota match), then mark their packets individually (each computer has its own mangle chain (FWD_WWW-$computernumber)) with its computernumber in hex, so tc can slow down their connection to 56k and after the "slow quota" is used up, the users packets get a different mark (mark 1) and get a DNAT to an Over Quota webpage, when the user tries to access an outside webpage, other connectionattempts get droped.
Quoted 2 lines
The problem is now, that pakets get marked with the mark
0x1, but in PREROUTING nat table, this mark never appears.
http://www.imagestream.com/~josh/PacketFlow.png
PREROUTING comes before FORWARD.
Quoted 4 lines
Thanks, Clemens
Jan Engelhardt
So, something marked with -j MARK can't be matched on nat table, right?
What if after you mark the packet with -j MARK, you do "-m mark --mark X -j CONNMARK --save-mark"; it should be visible from nat table or must be marked with -j CONNMARK --set-mark?
Quoted 3 lines
Quoted 2 lines
What marks, per-packet marks or per-connection marks?
I am not sure, how to distinguish, I just mark all pakets that pass
-j MARK => per-packet
-j CONNMARK => per-connection
Quoted 7 lines
through a certain user defined chain. I guess this is a mark per packet. The particular chain lookes like this:
Chain FWD_WWW-101 (2 references)
target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
Quoted 7 lines
100000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x65
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
1000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x1
MARK is only allowed in the mangle table.
Quoted 12 lines
The goal is to provide full network speed for all NATed computers for a certain amount of bytes (first quota match), then mark their packets individually (each computer has its own mangle chain (FWD_WWW-$computernumber)) with its computernumber in hex, so tc can slow down their connection to 56k and after the "slow quota" is used up, the users packets get a different mark (mark 1) and get a DNAT to an Over Quota webpage, when the user tries to access an outside webpage, other connectionattempts get droped.
Quoted 2 lines
The problem is now, that pakets get marked with the mark
0x1, but in PREROUTING nat table, this mark never appears.
http://www.imagestream.com/~josh/PacketFlow.png
PREROUTING comes before FORWARD.
Quoted 4 lines
Thanks, Clemens
Jan Engelhardt
Quoted 2 lines
So, something marked with -j MARK can't be matched on nat table, right?
You have to mark it in the PREROUTING chain of the mangle table, to be able to match on it within the PREROUTING chain of the nat table.
--- Orig msg ---
Quoted 46 lines
What if after you mark the packet with -j MARK, you do "-m mark --mark X -j CONNMARK --save-mark"; it should be visible from nat table or must be marked with -j CONNMARK --set-mark?
Quoted 3 lines
Quoted 2 lines
What marks, per-packet marks or per-connection marks?
I am not sure, how to distinguish, I just mark all pakets that pass
(quoted diff) +0
-2-j MARK => per-packet -j CONNMARK => per-connectionQuoted 8 lines
through a certain user defined chain. I guess this is a mark per packet. The particular chain lookes like this:
Chain FWD_WWW-101 (2 references)
target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:Quoted 7 lines
100000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x65
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
1000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x1MARK is only allowed in the mangle table.
Quoted 12 lines
The goal is to provide full network speed for all NATed computers for a certain amount of bytes (first quota match), then mark their packets individually (each computer has its own mangle chain (FWD_WWW-$computernumber)) with its computernumber in hex, so tc can slow down their connection to 56k and after the "slow quota" is used up, the users packets get a different mark (mark 1) and get a DNAT to an Over Quota webpage, when the user tries to access an outside webpage, other connectionattempts get droped.
Quoted 2 lines
The problem is now, that pakets get marked with the mark
0x1, but in PREROUTING nat table, this mark never appears.
Quoted 13 lines
PREROUTING comes before FORWARD.
Quoted 4 lines
Thanks, Clemens
Jan Engelhardt
Jan Engelhardt
Quoted 4 lines
You have to mark it in the PREROUTING chain of the mangle table, to be able to match on it within the PREROUTING chain of the nat table.
Is this also true, if I jump from PREROUTING mangle in a user defined chain and mark my packets there?
--
Clemens
Review
Quoted 2 lines
(quoted diff) +0
-2-j MARK => per-packet -j CONNMARK => per-connection
thank you
Quoted 16 lines
Quoted 8 lines
through a certain user defined chain. I guess this is a mark per packet. The particular chain lookes like this:
Chain FWD_WWW-101 (2 references)
target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:Quoted 7 lines
100000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x65
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 quota:
1000000 bytes
MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK
set0x1
Quoted 2 lines
MARK is only allowed in the mangle table.
Yes I know that. The abstract above comes from the mangle table, the name of the userdefined chain (which I jump into from PREROUTING mangle) might be a bit irritating, I admit, but it has nothing to do with FORWARD.
Quoted 3 lines
http://www.imagestream.com/~josh/PacketFlow.png
PREROUTING comes before FORWARD.
Yes I also know that. The Packets get marked correctly, I checked that in FORWARD filter, but in PREROUTING nat they are not, even though they should have been, hence I cannot dnat
--
Clemens
Quoted 6 lines
Quoted 3 lines
You have to mark it in the PREROUTING chain of the mangle table, to be able to match on it within the PREROUTING chain of the nat table.
Is this also true, if I jump from PREROUTING mangle in a user defined chain and mark my packets there?
Just make sure it gets marked in a table/chain (or subchain thereof) before the nat-PREROUTING chain is hit, according to
http://www.imagestream.com/~josh/PacketFlow-new.png
Jan Engelhardt
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Jan Engelhardt:
Quoted 10 lines
Quoted 5 lines
Quoted 3 lines
You have to mark it in the PREROUTING chain of the mangle table, to be able to match on it within the PREROUTING chain of the nat table.
Is this also true, if I jump from PREROUTING mangle in a user defined chain and mark my packets there?
Just make sure it gets marked in a table/chain (or subchain thereof) before the nat-PREROUTING chain is hit, according to
http://www.imagestream.com/~josh/PacketFlow-new.png
Good stuff , very clear flow !
Thank you !
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFHg7e7tZp58UCwyMRAqgDAJ9mVf92fMHZUL5PHhL0UtNBJn9nnACfS4rx UG7NZsE/bgQMsbQTYnzCMdo=
=5FpZ
-----END PGP SIGNATURE-----