1

I have a problem! So, I have two providers and a routing server on CentOS7. I can not get the marking to work through the second provider. The essence is this: With the first provider everything is fine, it is not highlighted in a separate table. A simple rule for MASQUERADE and a rule for a firewall.

iptables -t nat -I POSTROUTING -s MY_IP -j MASQUERADE
iptables -I RH-Firewall-1-INPUT -m mac --mac-source MY_MAC -j ACCEPT

The second provider sits in a separate table, in the table itself there is only the default route and a couple of rules:

ip route show table 2
default via GATEWAY_OF_PROVIDER dev eth2.2

ip rule show
from GATEWAY_OF_PROVIDER lookup 2
from all fwmark 0x2 lookup 2

Outcome: If I add a rule:

ip rule add from MY_IP lookup 2

, then everything works, and if I add

iptables -t mangle -I PREROUTING -s MY_IP -j MARK --set-mark 2

, everything breaks at the provider's gateway.

trace with manual rule:

  1    <1 мс    <1 мс    <1 мс  gate.dtbyh.ru [192.168.0.XX]
  2    <1 мс    <1 мс    <1 мс  ipXXX.XXX.XXX.XXX.ipblk.stnsk.ru [195.189.218.73]
  3     1 ms     1 ms    <1 мс  gw.stnsk.ru [XX.XX.XX.XX]
  4     1 ms     1 ms     1 ms  startel-gw.mega-com.ru [XXX.XX.XX.XX]
  5     1 ms     1 ms     1 ms  kuchum-xe-0-0-2.yndx.net [XX.XX.XX.XX]
  6    46 ms    61 ms    50 ms  sverdlov-xe-0-0-3.yndx.net [213.180.213.68]
  7    46 ms    46 ms    46 ms  styri-et-10-3-0-901.yndx.net [213.180.213.18]
  8    63 ms    47 ms    47 ms  m9-p2-eth-trunk8.yndx.net [87.250.239.127]

trace with mark rule:

  1    <1 мс    <1 мс    <1 мс  gate [192.168.0.XX]
  2     *       <1 мс    <1 мс  ipXXX.XXX.XXX.XXX.ipblk.stnsk.ru [XX.XXX.XXX.XX]
  3     *        *        *     
  4     *        *        *     

ie the marking is work, but it does not let go of the gateway.

sysctl:
net.ipv4.conf.default.accept_source_route = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0

Thank you!

0

Problem is solved. RHEL>6 sysctl:

net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.