Before I ask my question, let me first pose the situation:
- I have 2 network interfaces: eth0 and eth1
- I bridge those 2 (using brctl) and form a new interface: br0
- This bridge gets the ip address 192.168.1.130
- I'm running a custom linux (3.12 kernel from ti), with busybox, iptables, ebtables, arptables and nginx with php-fpm on a beaglebone.
The problem that I want to solve:
- I want to be able to chose any interface to plug my network cable into, and still use the same IP address to access an administration website on this device. However, I'd like to know which physical device was used to access the site.
My wannabe solution:
- I thought about simply "marking" packetings coming from physdev eth1 as "1", so that I could DNAT this into another port. This different port would be much simpler to detect in nginx/php. For eth0 I use port 80, whilst for eth1 is use port 81.
My iptables entries:
iptables -t mangle -A PREROUTING -m physdev --physdev-in eth1 -j MARK --set-mark 0x01 iptables -t nat -A PREROUTING -p tcp --dport 80 -m mark --mark 0x01 -j DNAT --to-destination :81
What happens (a.k.a. the actual problem):
- The marking seems to work when I'm locally connected to the device, meaning, there's not much traffic going on. However, when I'm on my company network, I get a whole lot more traffic which apparantly causes this trick to fail. This is visible because being plugged in in interface eth0, causes the port 80 to be used, where I expected port 81. However, if I refresh rapidly a few times, I see that port 81 gets used... so, this makes me more confused.
When I run: iptables -t nat -L -n -v
I see that the rule only nats a few packets, certainly not all packets. I test this simply by looking at the pkts counter after each page refresh (although, maybe my browser doesn't always refresh). Could this be due too browser caching or something?
edit: it has nothing to do with browser caching apparantly.
Thank you in advance!
Kind regards, Xabre