netdev - Re: two gateways with one NIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 09 Apr 2007 16:56:20 +0100
From:	W Agtail <wagtail@....ie>
To:	Lennart Sorensen <lsorense@...lub.uwaterloo.ca>
Cc:	netdev@...r.kernel.org
Subject: Re: two gateways with one NIC

On Mon, 2007-04-09 at 10:54 -0400, Lennart Sorensen wrote:
> On Sun, Apr 08, 2007 at 08:29:07PM +0100, W Agtail wrote:
> > This is what I'm trying to achieve with the following iptables/iproute2
> > configuration on both web servers:
> > 
> > iptables -t mangle -A PREROUTING -p tcp --dport 8088 -i eth0 -j LOG
> > --log-prefix "fwmark 1: "
> > iptables -t mangle -A PREROUTING -p tcp --dport 8089 -i eth0 -j LOG
> > --log-prefix "fwmark 2: "
> > 
> > iptables -t mangle -A PREROUTING -p tcp --dport 8088 -i eth0 -j MARK
> > --set-mark 1
> > iptables -t mangle -A PREROUTING -p tcp --dport 8089 -i eth0 -j MARK
> > --set-mark 2
> 
> You are supposed to mangle things _coming_ from port 8088 and 8089.
> After all it is the replies you are trying to affect, not the requests.
> So it should be the --sport not --dport.  And of course outbound not
> incoming on eth0.
> 
> > iptables -t mangle -A PREROUTING -m mark --mark 1 -j LOG --log-prefix
> > "marked 1: "
> > iptables -t mangle -A PREROUTING -m mark --mark 2 -j LOG --log-prefix
> > "marked 2: "
> > 
> > ip route add table 1 default via 10.18.35.11 dev eth0 # GW1
> > ip route add table 2 default via 10.18.35.21 dev eth0 # GW2
> > 
> > ip rule add fwmark 1 table 1
> > ip rule add fwmark 2 table 2
> > 
> > On web2, the default gw is set to gw2 and in /var/log/messages, I can
> > see packets appear to be marked. However, for some reason, 8088 is still
> > routing back via gw2 (default gw) rather than being routed via gw1,
> > which I'm trying to do with the above ip rules etc.
> > 
> > Is the above the correct syntax? or I guess I could totally be missing
> > the plot?
> > 
> > Many thanks for your time on this one.
> 
> Hope that helps.
> 
> --
> Len Sorensen

Hi there, and thanks v. much for getting back to me on this one.
I now have changed iptables on the web servers to the following:

iptables -t mangle -A POSTROUTING -p tcp --sport 8088 -o eth0 -j MARK
--set-mark 1
iptables -t mangle -A POSTROUTING -p tcp --sport 8089 -o eth0 -j MARK
--set-mark 2

But I'm still seeing traffic being returned via gw2 for port 8088 :(
Any ideas? Thanks.

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html