In my setup multicast TX traffic was marked by iptables but policy routing using new routing tables never worked. Though it worked for unicast TX packets (redirecting originating packets from eth0 to eth5). Using tc i could get eth0 mcast traffic to eth5 The src mac and src ip address are changed t that of eth5 so will no create issues with switch learnings. All kernel support for kernel packet scheduling CONFIG_NET_SCHED must be enabled
Below WORKS for unicast and multicast traffic redirecting from eth0 to eth5
Netfilter can be used to interact directly with the structure representing a packet in the kernel. This structure,
the sk_buff, contains a field called “__u32 nfmark” that we are going to modify.
TC will then read that value to select the destination class of a packet.
IP_ADDR_ETH0=ifconfig eth0 | grep 'inet addr'| cut -d ':' -f 2 | cut -d ' ' -f 1 | tr -d '\n'
iptables -t mangle -A OUTPUT -s ${IP_ADDR_ETH0} -p udp --match multiport --dports 329,330 -o eth0 -j MARK --set-mark 2
Going to create a tree that represents our scheduling policy, and that uses the PRIO qdisc (packet scheduler) (can try other available ones).
qdiscs attaching at the root of a device
tc qdisc add dev eth0 root handle 15: prio
Now have on one side a traffic shaping policy, and on the other side packets marking. To connect the two, we need a filter.
refer man tc-mirred(8):
The mirred action allows packet mirroring (copying) or redirecting
(stealing) the packet it receives. Mirroring is what is sometimes referred to as Switch Port Analyzer (SPAN) and is commonly used to analyze and/or debug flows.
refer man tc-fw(8):
fw - fwmark traffic control filter
the fw filter allows to classify packets based on a previously set fwmark by iptables. If it is identical to the filter's 'handle', the filter matches. iptables allows to mark single packets with the MARK target, or whole connections using CONNMARK.
MAC_ADDR_ETH1=cat /sys/class/net/eth1/address
IP_ADDR_ETH1=ifconfig eth1 | grep 'inet addr'| cut -d ':' -f 2 | cut -d ' ' -f 1 | tr -d '\n'
tc filter add dev eth0 parent 15:0 protocol ip prio 1 handle 0x2 fw action pedit ex munge eth src set ${MAC_ADDR_ETH1} pipe \
action pedit ex munge ip src set ${IP_ADDR_ETH1} pipe \
action mirred egress redirect dev eth1
show above set rules:
tc qdisc show dev eth0
tc filter show dev eth0
delete/unset above set rules:
tc qdisc del dev eth0 root