netdev
[Top] [All Lists]

Re: iptables breakage WAS(Re: dummy as IMQ replacement

To: hadi@xxxxxxxxxx
Subject: Re: iptables breakage WAS(Re: dummy as IMQ replacement
From: Andy Furniss <andy.furniss@xxxxxxxxxxxxx>
Date: Fri, 25 Mar 2005 19:59:46 +0000
Cc: Harald Welte <laforge@xxxxxxxxxxxx>, Patrick McHardy <kaber@xxxxxxxxx>, Remus <rmocius@xxxxxxxxxxxxxx>, netdev@xxxxxxxxxxx, Nguyen Dinh Nam <nguyendinhnam@xxxxxxxxx>, Andre Tomt <andre@xxxxxxxx>, syrius.ml@xxxxxxxxxx, Damion de Soto <damion@xxxxxxxxxxxx>
In-reply-to: <1111749220.1092.457.camel@xxxxxxxxxxxxxxxx>
References: <1107123123.8021.80.camel@xxxxxxxxxxxxxxxx> <1110416767.1111.76.camel@xxxxxxxxxxxxxxxx> <025501c52552$2dbf87c0$6e69690a@RIMAS> <1110453757.1108.87.camel@xxxxxxxxxxxxxxxx> <423B7BCB.10400@xxxxxxxxxxxxx> <1111410890.1092.195.camel@xxxxxxxxxxxxxxxx> <423F41AD.3010902@xxxxxxxxxxxxx> <1111444869.1072.51.camel@xxxxxxxxxxxxxxxx> <423F71C2.8040802@xxxxxxxxxxxxx> <1111462263.1109.6.camel@xxxxxxxxxxxxxxxx> <42408998.5000202@xxxxxxxxxxxxx> <1111550254.1089.21.camel@xxxxxxxxxxxxxxxx> <4241C478.5030309@xxxxxxxxxxxxx> <1111607112.1072.48.camel@xxxxxxxxxxxxxxxx> <4241D764.2030306@xxxxxxxxxxxxx> <1111612042.1072.53.camel@xxxxxxxxxxxxxxxx> <4241F1D2.9050202@xxxxxxxxxxxxx> <4241F7F0.2010403@xxxxxxxxxxxxx> <1111625608.1037.16.camel@xxxxxxxxxxxxxxxx> <424212F7.10106@xxxxxxxxxxxxx> <1111663947.1037.24.camel@xxxxxxxxxxxxxxxx> <1111665450.1037.27.camel@xxxxxxxxxxxxxxxx> <4242DFB5.9040802@xxxxxxxxxxxxx> <1111749220.1092.457.camel@xxxxxxxxxxxxxxxx>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b) Gecko/20050217
jamal wrote:

I gotta give it to you - you have helped isolate more bugs in this one
session than all others in the past summed up.

LOL - there may be more to come, though I haven't used CONNMARK before and may be missing something about it - and maybe there is a tc way to look at connmark anyway?

Works as I expect -

iptables -A POSTROUTING -t mangle -j CONNMARK --set-mark 1
iptables -A INPUT -t mangle -m mark --mark 1
iptables -A PREROUTING -t mangle -j CONNMARK --restore-mark

I ping a lan pc and I get matches for the marked incoming packets in INPUT.

If I do

iptables -A POSTROUTING -t mangle -j CONNMARK --set-mark 1
iptables -A INPUT -t mangle -m mark --mark 1
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src 0/0 flowid 1:1 action ipt -j CONNMARK --restore-mark

It doesn't mark the packets.

3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.355/0.415/0.529/0.081 ms
[root@amd /home/andy/Qos]# tc -s filter ls dev eth0 parent ffff:
filter protocol ip pref 6 u32
filter protocol ip pref 6 u32 fh 800: ht divisor 1
filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 (rule hit 3 success 3)
  match 00000000/00000000 at 12 (success 3 )
        action order 1: tablename: mangle  hook: NF_IP_PRE_ROUTING
        target CONNMARK restore
        index 2 ref 1 bind 1 installed 44 sec used 31 sec
        Action statistics:
        Sent 252 bytes 3 pkt (dropped 0, overlimits 0 requeues 0)
        rate 0bit 0pps backlog 0b 0p requeues 0

[root@amd /home/andy/Qos]# iptables -L -t mangle -v
Chain PREROUTING (policy ACCEPT 364 packets, 401K bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 364 packets, 401K bytes)
pkts bytes target prot opt in out source destination 0 0 all -- any any anywhere anywhere MARK match 0x1

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 300 packets, 19702 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 300 packets, 19702 bytes)
pkts bytes target prot opt in out source destination 3 252 CONNMARK all -- any any anywhere anywhere CONNMARK set 0x1

Andy.



<Prev in Thread] Current Thread [Next in Thread>