From: Grant Edwards <grant.b.edwards@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: [gentoo-user] Re: OT: default route dependent on dest port?
Date: Fri, 4 Oct 2013 22:15:58 +0000 (UTC) [thread overview]
Message-ID: <l2nemu$3ng$1@ger.gmane.org> (raw)
In-Reply-To: 524F37E4.6040106@fastmail.co.uk
On 2013-10-04, Kerin Millar <kerframil@fastmail.co.uk> wrote:
> On 04/10/2013 21:55, Grant Edwards wrote:
>> I then add an iptables rule like this:
>>
>> iptables -A OUTPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 1
I'm about to try adding a second iptables rule to us the nat table to
rewrite the source IP address. Something like this:
iptables -A POSTROUTING -t nat -o net2 -m mark --mark 1 -j SNAT --to 172.16.1.2
> It would help if you were to also supply the details of:
>
> * ip -f inet -o a s
$ ip -f inet -o a s
1: lo inet 127.0.0.1/8 scope host lo
2: net0 inet 192.168.8.4/16 brd 192.168.255.255 scope global net0
3: net1 inet 10.0.0.1/8 brd 10.255.255.255 scope global net1
3: net1 inet 192.168.250.1/24 brd 192.168.250.255 scope global net1
3: net1 inet 192.168.1.1/24 brd 192.168.1.255 scope global net1
3: net1 inet 169.254.1.1/16 brd 169.254.255.255 scope global net1
5: net2 inet 172.16.1.2/16 brd 172.16.255.255 scope global net2
> * ip route show table main
$ ip route show table main
default via 192.168.0.254 dev net0 metric 2
10.0.0.0/8 dev net1 proto kernel scope link src 10.0.0.1
127.0.0.0/8 via 127.0.0.1 dev lo
169.254.0.0/16 dev net1 proto kernel scope link src 169.254.1.1
172.16.0.0/16 dev net2 proto kernel scope link src 172.16.1.2 metric 5
192.168.0.0/16 dev net0 proto kernel scope link src 192.168.8.4
192.168.1.0/24 dev net1 proto kernel scope link src 192.168.1.1
192.168.250.0/24 dev net1 proto kernel scope link src 192.168.250.1
> * ip route show table pmain
$ ip route show table pmain
default via 172.16.0.34 dev net2 metric 2
10.0.0.0/8 dev net1 proto kernel scope link src 10.0.0.1
127.0.0.0/8 via 127.0.0.1 dev lo
169.254.0.0/16 dev net1 proto kernel scope link src 169.254.1.1
172.16.0.0/16 dev net2 proto kernel scope link src 172.16.1.2 metric 5
192.168.0.0/16 dev net0 proto kernel scope link src 192.168.8.4
192.168.1.0/24 dev net1 proto kernel scope link src 192.168.1.1
192.168.250.0/24 dev net1 proto kernel scope link src 192.168.250.1
>
>>
>> Now all TCP packets destined for port 80 are sent to the 172.16
>> gateway, _but_ they're being sent with a 192.168 source address. The
>> TCP stack is apparently unaware of the advanced routing tricks and
>> thinks that the packets are going out via the 192.168 gateway.
>>
>> IOW I've succesfully re-routed TCP _packets_ but not the TCP
>> _connection_.
>>
>> How do I tell the TCP stack that it's supposed to use the 172.16
>> inteface/gateway for connections to port 80?
>
> --Kerin
>
>
--
Grant Edwards grant.b.edwards Yow! ! I'm in a very
at clever and adorable INSANE
gmail.com ASYLUM!!
next prev parent reply other threads:[~2013-10-04 22:16 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-04 20:55 [gentoo-user] OT: default route dependent on dest port? Grant Edwards
2013-10-04 21:49 ` Kerin Millar
2013-10-04 22:15 ` Grant Edwards [this message]
2013-10-04 22:50 ` [gentoo-user] " Grant Edwards
2013-10-04 23:08 ` Grant Edwards
2013-10-04 22:08 ` [gentoo-user] " Dragostin Yanev
2013-10-04 22:44 ` [gentoo-user] " Grant Edwards
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='l2nemu$3ng$1@ger.gmane.org' \
--to=grant.b.edwards@gmail.com \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox