Re: Changing fwmarks stalls connection... | |
| [Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] | |
Mandi! Niccolò Belli
In chel di` si favelave...
> I do CONNMARK RESTORE on PREROUTING:
> I MARK in FORWARD:
> I do CONNMARK SAVE in POSTROUTING:
All good hints. Thanks. Now i have:
1) restore on prerouting:
$IPT -t mangle -A PREROUTING -m conntrack --ctstate ESTABLISHED,RELATED \
-j CONNMARK --restore-mark
2) mark on forward:
$IPT -t mangle -A FORWARD -j mrk-pre-fwd
$IPT -t mangle -A FORWARD -m state --state NEW -m mark --mark 0 -j mrk-post-fwd
3) mark moved from output to postrouting, with save:
$IPT -t mangle -A POSTROUTING -j mrk-pre-out
$IPT -t mangle -A POSTROUTING -m state --state NEW -m mark --mark 0 -j mrk-post-out
$IPT -t mangle -A POSTROUTING -m mark --mark 0 -j MARK --set-mark $DEFAULT
$IPT -t mangle -A POSTROUTING -m mark ! --mark 0 -j CONNMARK --save-mark
I use mrk-pre-fwd and mrk-pre-out to ''force'' marks for some type of
traffic or interfaces, while i use mrk-post-fwd and mrk-post-out for
generic marking, only for new traffic.
> You should check if everything is going fine using LOG/ULOG target:
> iptables -t mangle -A FORWARD -i ${EXT1} -o ethWEB -p tcp -m
> multiport --dports 80,443 -m state --state NEW -j LOG --log-prefix
> "**NEW** IN NAS0 "
I've setup a log entry:
$IPT -t mangle -A POSTROUTING -m state --state NEW -j LOG --log-prefix "T=mangle C=PSTR A=new L=warn "
and do some test, leaving logging flow for some minutes... all marking
goes well, no NEW packet got class '0'.
> FORWARD chain, the OUTPUT one can be much more challenging (for
> example having EXT1 as default gateway I have to ALLOW a specific
> traffic toward EXT1 even if I want it to go through EXT2, otherwise
> the system will not forge the packet).
I moved th marking from OUTPUT to postrouting; i've revamped my script
exactly to match more closely local-generated traffic from forward
traffic, so...
Anyway, very little changed: still a simple browser to a ''complex''
site like, you know, corriere.it or repubblica.it, stalls.
If i restore my old script, that use only POSTROUTING, all works
flawlessy.
And, i'm really angry, i don't understand why. ;-(((
--
dott. Marco Gaiarin GNUPG Key ID: 240A3D66
Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/
Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN)
marco.gaiarin(at)sv.lnf.it tel +39-0434-842711 fax +39-0434-842797
Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
http://www.lanostrafamiglia.it/chi_siamo/5xmille.php
(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
--
To unsubscribe from this list: send the line "unsubscribe lartc" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html