routing based on MARK problem
Hi all,
In my network routing based on MARK do not work. Return packets (SYN - ACK) do not reach client.
My network :
local area -------
|
|--------------eth0 server eth1 --------------
provider 1
|external N------ I want to assure access to "external N " from "local area" I prepared new routing table :
ip rule add fwmark 5 table EXTERNAL
ip route add default via $EXTERNAL_NETWORK_GW_IP dev eth0 table EXTERNAL
next iptable rules:
iptables -t nat PREROUTING -t mangle -i eth0 [DST PORT/ADDRESSES RULES] -j MARK --set-mark 5 to disable NAT and redirection to proxy:
iptables -t nat PREROUTING -m mark --mark 5 -j ACCPET iptables -t nat POSTROUTING -m mark --mark 5 -j ACCPET
tcpdump on "server" shows:
"local area IP " > "external N IP" SYNC
"local area IP" > "external N IP" SYNC
"external N IP" > "local area IP " SYNC ACK
last packet appears only once - that packet to not each host in local area
accept_reidirection and send_reisrections are disabled
What is wrong ?
Thanks for any suggestions.
Pawel