1

I have the following problem. I have SAs that use firewall marks. So only packets that have that mark get encoded and decoded. I managed to set the mark for packets that shall be encoded but I cannot get the other side working.

I have incoming packets that need to be decrypted and I need to set the correct mark for those. I CAN actually set the mark using the following command:

iptables -t mangle -A PREROUTING --proto esp -j MARK --set-mark 1

BUT that rule matches ALL incoming esp packets. Yet I will have multiple SAs and I need to set different marks. I tried to use select by reqid or by spi, but as soon as I try that, the rule does not match anything any more.

Can someone help me to get that iptables command right?

Best regards,
Steffen

root@vpn-b:~# setkey -D
10.5.0.2 10.5.0.1
        esp mode=tunnel spi=3296784692(0xc480f134) reqid=1(0x00000001)
        E: aes-cbc  c5eb72ab 906d5717 67e405f5 cfe73f7a
        A: hmac-sha1  6935290e e51f0965 06577876 0d6237d6 45a0083d
        seq=0x00000000 replay=32 flags=0x00000000 state=mature
        created: May 15 22:23:06 2012   current: May 15 22:24:43 2012
        diff: 97(s)     hard: 1200(s)   soft: 907(s)
        last: May 15 22:23:19 2012      hard: 0(s)      soft: 0(s)
        current: 7140(bytes)    hard: 0(bytes)  soft: 0(bytes)
        allocated: 85   hard: 0 soft: 0
        sadb_seq=1 pid=8282 refcnt=0
10.5.0.1 10.5.0.2
        esp mode=tunnel spi=3470192236(0xced6ee6c) reqid=1(0x00000001)
        E: aes-cbc  e6fad1a5 ff31325b b4856748 c8997ea1
        A: hmac-sha1  e401cc9d 59668c9f 866d7e86 b5a38d2c 1dcb2f2d
        seq=0x00000000 replay=32 flags=0x00000000 state=mature
        created: May 15 22:23:06 2012   current: May 15 22:24:43 2012
        diff: 97(s)     hard: 1200(s)   soft: 888(s)
        last: May 15 22:23:19 2012      hard: 0(s)      soft: 0(s)
        current: 7140(bytes)    hard: 0(bytes)  soft: 0(bytes)
        allocated: 85   hard: 0 soft: 0
        sadb_seq=0 pid=8282 refcnt=0

root@vpn-b:~# ip -s xfrm policy
src 10.1.1.0/24 dst 10.2.1.0/24 uid 0
        dir fwd action allow index 1218 priority 1859 share any flag  (0x00000000)
        lifetime config:
          limit: soft (INF)(bytes), hard (INF)(bytes)
          limit: soft (INF)(packets), hard (INF)(packets)
          expire add: soft 0(sec), hard 0(sec)
          expire use: soft 0(sec), hard 0(sec)
        lifetime current:
          0(bytes), 0(packets)
          add 2012-05-15 22:08:11 use 2012-05-15 22:18:27
        mark 1/0xffffffff
        tmpl src 10.5.0.1 dst 10.5.0.2
                proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
                level required share any
                enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
src 10.1.1.0/24 dst 10.2.1.0/24 uid 0
        dir in action allow index 1208 priority 1859 share any flag  (0x00000000)
        lifetime config:
          limit: soft (INF)(bytes), hard (INF)(bytes)
          limit: soft (INF)(packets), hard (INF)(packets)
          expire add: soft 0(sec), hard 0(sec)
          expire use: soft 0(sec), hard 0(sec)
        lifetime current:
          0(bytes), 0(packets)
          add 2012-05-15 22:08:11 use -
        mark 1/0xffffffff
        tmpl src 10.5.0.1 dst 10.5.0.2
                proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
                level required share any
                enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff
src 10.2.1.0/24 dst 10.1.1.0/24 uid 0
        dir out action allow index 1201 priority 1859 share any flag  (0x00000000)
        lifetime config:
          limit: soft (INF)(bytes), hard (INF)(bytes)
          limit: soft (INF)(packets), hard (INF)(packets)
          expire add: soft 0(sec), hard 0(sec)
          expire use: soft 0(sec), hard 0(sec)
        lifetime current:
          0(bytes), 0(packets)
          add 2012-05-15 22:08:11 use 2012-05-15 22:18:27
        mark 1/0xffffffff
        tmpl src 10.5.0.2 dst 10.5.0.1
                proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel
                level required share any
                enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff

2 Answers 2

2

My search process got me on this page and decided to write. Since ESP packets are flowing between the peers, you could add aditional arguments, such as source and destination IP addresses to your iptables. That would differentiate esp packets and you could apply different marks after. For example from peer 100.100.100.100 to peer 200.200.200.200 (assuming that 200.200.200.200 is your side) you would have rule like this in your /etc/iptables.up.rules

*mangle

# Marking the ESP packets between peer A and peer B
-A INPUT -p esp -s 100.100.100.100 -d 200.200.200.200 -j MARK  --set-mark 10

Respectively ESP packets that belong to another tunnel would be marked like this (assuming that again 200.200.200.200 is your side and 150.100.100.100 is remote peer)

# Marking the ESP packets between peer C and peer B
-A INPUT -p esp -s 150.100.100.100 -d 200.200.200.200 -j MARK  --set-mark 20
1

Try policy match module from iptables:

-m policy --reqid $ID

More details in man iptables(8).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .