In previous message I attached files with the required info.
In /var/log/messages I have seen that --physdev-out is deprecated now (bad
notices for me).
Anyone can help me with the issues explained previously?
Thanks
El Vie, 23 de Marzo de 2007, 0:24, ArcosCom Linux User escribió:
> I attach 2 txt files:
> rt_status: ip route info + iptables mangle info.
> iptables_nat.txt: iptables -t nat -vnL
>
> The questions and the issues are in the original e-mail (above).
>
> Thanks
>
> El Jue, 22 de Marzo de 2007, 9:28, ArcosCom Linux User escribió:
>> Any help please?
>>
>> Thanks.
>>
>> El Lun, 19 de Marzo de 2007, 23:57, ArcosCom Linux User escribió:
>>> Hi, I have a suspicious problem with multiple uplinks configuration.
>>> First of all my configuration:
>>> 1) kernel 2.6.20.3
>>> 2) iptables 1.3.7
>>> 3) last iproute (for masked marks)
>>>
>>> All wan interfaces are bridged (stp disabled) in only one interface
>>> (wan0), all lan interfaces are bridged (stp enabled) in only one
>>> interface
>>> (zlan0).
>>>
>>> The wan0 bridge is to allow UPnP works.
>>>
>>> To allow related incoming traffic from one fisical interface I mark
>>> connections, and the same to allow outgoing related.
>>>
>>> The routing rules are the same than lartc documentation plus a rule by
>>> interface to allow the routing using marks (masked).
>>>
>>> The comands I use are:
>>>
>>> ==BEGIN==
>>> /sbin/ip rule del prio 50 table main
>>> /sbin/ip rule del prio 100 fwmark 0x8000/0xf000 table 150
>>> /sbin/ip rule del prio 150 from 217.125.139.204/26 table 150
>>> /sbin/ip rule del prio 101 fwmark 0x4000/0xf000 table 151
>>> /sbin/ip rule del prio 151 from 80.32.61.58/24 table 151
>>> /sbin/ip rule del prio 200 table 200
>>> /sbin/ip route flush table 150
>>> /sbin/ip route flush table 151
>>> /sbin/ip route flush table 200
>>> /sbin/iptables -t mangle -D PREROUTING -j MARCAR_IFACE
>>> /sbin/iptables -t mangle -F MARCAR_IFACE
>>> /sbin/iptables -t mangle -X MARCAR_IFACE
>>> /sbin/iptables -t mangle -F MARCAR_IFACE_TRAFICO
>>> /sbin/iptables -t mangle -X MARCAR_IFACE_TRAFICO
>>> /sbin/iptables -t mangle -D POSTROUTING -j MARCAR_IFACE_OUT
>>> /sbin/iptables -t mangle -F MARCAR_IFACE_OUT
>>> /sbin/iptables -t mangle -X MARCAR_IFACE_OUT
>>> /sbin/iptables -t mangle -N MARCAR_IFACE
>>> /sbin/iptables -t mangle -N MARCAR_IFACE_TRAFICO
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -j CONNMARK --restore-mark
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -m mark ! --mark 0x0000/0xf000
>>> -j
>>> RETURN
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -m mark --mark 0x0000/0xf000
>>> -j
>>> MARCAR_IFACE_TRAFICO
>>> /sbin/iptables -t mangle -N MARCAR_IFACE_OUT
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -j CONNMARK --restore-mark
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark ! --mark
>>> 0x0000/0xf000 -j RETURN
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -m mark --mark 0x0000/0xf000
>>> -i
>>> wan0 -m physdev --physdev-in eth1 -m state --state NEW -j MARK
>>> --or-mark
>>> 0x8000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctreplsrc 217.125.139.204 -j MARK --or-mark
>>> 0x8000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctrepldst 217.125.139.204 -j MARK --or-mark
>>> 0x8000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -s 217.125.139.204 -j MARK --or-mark 0x8000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctorigsrc 217.125.139.204 -j MARK --or-mark
>>> 0x8000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctorigdst 217.125.139.204 -j MARK --or-mark
>>> 0x8000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -m mark --mark 0x0000/0xf000
>>> -i
>>> wan0 -m physdev --physdev-in eth3 -m state --state NEW -j MARK
>>> --or-mark
>>> 0x4000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctreplsrc 80.32.61.58 -j MARK --or-mark 0x4000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctrepldst 80.32.61.58 -j MARK --or-mark 0x4000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -s 80.32.61.58 -j MARK --or-mark 0x4000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctorigsrc 80.32.61.58 -j MARK --or-mark 0x4000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -m mark --mark
>>> 0x0000/0xf000
>>> -o wan0 -m conntrack --ctorigdst 80.32.61.58 -j MARK --or-mark 0x4000
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -j CONNMARK --save-mark
>>> /sbin/iptables -t mangle -A MARCAR_IFACE -j RETURN
>>> /sbin/iptables -t mangle -I PREROUTING -j MARCAR_IFACE
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -j CONNMARK --save-mark
>>> /sbin/iptables -t mangle -A MARCAR_IFACE_OUT -j RETURN
>>> /sbin/iptables -t mangle -I POSTROUTING -j MARCAR_IFACE_OUT
>>> /sbin/ip rule add prio 50 table main
>>> /sbin/ip rule add prio 100 fwmark 0x8000/0xf000 table 150
>>> /sbin/ip rule add prio 150 from 217.125.139.204/26 table 150
>>> /sbin/ip route add default via 217.125.139.193 dev wan0 src
>>> 217.125.139.204 proto static table 150
>>> /sbin/ip route append prohibit default table 150 metric 1 proto static
>>> /sbin/ip rule add prio 101 fwmark 0x4000/0xf000 table 151
>>> /sbin/ip rule add prio 151 from 80.32.61.58/24 table 151
>>> /sbin/ip route add default via 80.32.61.1 dev wan0 src 80.32.61.58
>>> proto
>>> static table 151
>>> /sbin/ip route append prohibit default table 151 metric 1 proto static
>>> /sbin/ip rule add prio 200 table 200
>>> /sbin/ip route add default table 200 proto static nexthop via
>>> 217.125.139.193 dev wan0 weight 1 nexthop via 80.32.61.1 dev wan0
>>> weight
>>> 1
>>> /sbin/ip route flush cache
>>> ==END==
>>>
>>> I have this "output" for all chains and routes:
>>> ==BEGIN==
>>> === REGLAS IPTABLES PARA EL ENRUTADO ===
>>> Chain PREROUTING (policy ACCEPT 8664K packets, 5097M bytes)
>>> num pkts bytes target prot opt in out source
>>> destination
>>> 1 3348K 1832M MARCAR_IFACE 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0
>>> Chain MARCAR_IFACE (1 references)
>>> num pkts bytes target prot opt in out source
>>> destination
>>> 1 3348K 1832M CONNMARK 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0 CONNMARK restore
>>> 2 2841K 1653M RETURN 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0 MARK match !0x0/0xf000
>>> 3 507K 179M MARCAR_IFACE_TRAFICO 0 -- * *
>>> 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000
>>> 4 40690 2721K MARK 0 -- wan0 * 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 PHYSDEV match --physdev-in
>>> eth1
>>> state NEW MARK or 0x8000
>>> 5 48680 3062K MARK 0 -- wan0 * 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 PHYSDEV match --physdev-in
>>> eth3
>>> state NEW MARK or 0x4000
>>> 6 507K 179M CONNMARK 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0 CONNMARK save
>>> 7 507K 179M RETURN 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0
>>> Chain MARCAR_IFACE_TRAFICO (1 references)
>>> num pkts bytes target prot opt in out source
>>> destination
>>> Chain POSTROUTING (policy ACCEPT 16M packets, 8665M bytes)
>>> num pkts bytes target prot opt in out source
>>> destination
>>> 1 6483K 3397M MARCAR_IFACE_OUT 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0
>>> Chain MARCAR_IFACE_OUT (1 references)
>>> num pkts bytes target prot opt in out source
>>> destination
>>> 1 6483K 3397M CONNMARK 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0 CONNMARK restore
>>> 2 5781K 2966M RETURN 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0 MARK match !0x0/0xf000
>>> 3 0 0 MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctreplsrc 217.125.139.204
>>> MARK
>>> or 0x8000
>>> 4 104K 7470K MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctrepldst 217.125.139.204
>>> MARK
>>> or 0x8000
>>> 5 135 7091 MARK 0 -- * wan0 217.125.139.204
>>> 0.0.0.0/0 MARK match 0x0/0xf000 MARK or 0x8000
>>> 6 0 0 MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctorigsrc 217.125.139.204
>>> MARK
>>> or 0x8000
>>> 7 0 0 MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctorigdst 217.125.139.204
>>> MARK
>>> or 0x8000
>>> 8 0 0 MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctreplsrc 80.32.61.58 MARK or
>>> 0x4000
>>> 9 101K 7298K MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctrepldst 80.32.61.58 MARK or
>>> 0x4000
>>> 10 175 7578 MARK 0 -- * wan0 80.32.61.58
>>> 0.0.0.0/0 MARK match 0x0/0xf000 MARK or 0x4000
>>> 11 0 0 MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctorigsrc 80.32.61.58 MARK or
>>> 0x4000
>>> 12 1 48 MARK 0 -- * wan0 0.0.0.0/0
>>> 0.0.0.0/0 MARK match 0x0/0xf000 ctorigdst 80.32.61.58 MARK or
>>> 0x4000
>>> 13 702K 431M CONNMARK 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0 CONNMARK save
>>> 14 702K 431M RETURN 0 -- * * 0.0.0.0/0
>>> 0.0.0.0/0
>>> === REGLAS DE ENRUTAMIENTO ===
>>> 0: from all lookup local
>>> 50: from all lookup main
>>> 100: from all fwmark 0x8000/0xf000 lookup uno
>>> 101: from all fwmark 0x4000/0xf000 lookup dos
>>> 150: from 217.125.139.204/26 lookup uno
>>> 151: from 80.32.61.58/24 lookup dos
>>> 200: from all lookup defecto
>>> 32766: from all lookup main
>>> 32767: from all lookup default
>>> === TABLAS DE RUTAS ===
>>> === MAIN ===
>>> 217.125.139.192/26 dev wan0 proto kernel scope link src
>>> 217.125.139.204
>>> 80.32.61.0/24 dev wan0 proto kernel scope link src 80.32.61.58
>>> 192.168.3.0/24 dev zlan0 proto kernel scope link src 192.168.3.247
>>> 192.168.2.0/24 dev zlan0 proto kernel scope link src 192.168.2.247
>>> 192.168.1.0/24 dev zlan0 proto kernel scope link src 192.168.1.247
>>> 10.1.1.0/24 dev zlan0 proto kernel scope link src 10.1.1.6
>>> 169.254.0.0/16 dev zlan0 scope link
>>> 239.0.0.0/8 dev zlan0 scope link
>>> === wan0 TABLA 150 ===
>>> default via 217.125.139.193 dev wan0 proto static src 217.125.139.204
>>> prohibit default proto static metric 1
>>> === wan0 TABLA 151 ===
>>> default via 80.32.61.1 dev wan0 proto static src 80.32.61.58
>>> prohibit default proto static metric 1
>>> === TABLA 200 (defecto) ===
>>> default proto static
>>> nexthop via 217.125.139.193 dev wan0 weight 1
>>> nexthop via 80.32.61.1 dev wan0 weight 1
>>>
>>> ==END==
>>>
>>> The -t nat POSTROUTING rules:
>>> ==BEGIN==Chain POSTROUTING (policy ACCEPT 58524 packets, 42M bytes)
>>> pkts bytes target prot opt in out source
>>> destination
>>> 0 0 SNAT 0 -- * eth3 10.1.1.0/24
>>> 0.0.0.0/0 to:80.32.61.58
>>> 0 0 SNAT 0 -- * eth1 10.1.1.0/24
>>> 0.0.0.0/0 to:217.125.139.204
>>> 0 0 SNAT 0 -- * wan0 10.1.1.0/24
>>> 0.0.0.0/0 PHYSDEV match --physdev-out eth3 to:80.32.61.58
>>> 0 0 SNAT 0 -- * wan0 10.1.1.0/24
>>> 0.0.0.0/0 PHYSDEV match --physdev-out eth1
>>> to:217.125.139.204
>>> 0 0 SNAT 0 -- * eth3 10.1.1.0/24
>>> 0.0.0.0/0 to:80.32.61.58
>>> 0 0 SNAT 0 -- * eth1 10.1.1.0/24
>>> 0.0.0.0/0 to:217.125.139.204
>>> 578K 39M MASQUERADE 0 -- * wan0 10.1.1.0/24
>>> 0.0.0.0/0
>>> 0 0 MASQUERADE 0 -- * wan0:1 10.1.1.0/24
>>> 0.0.0.0/0
>>> 0 0 SNAT 0 -- * wan0 10.1.1.0/24
>>> 0.0.0.0/0 to:80.32.61.58
>>> 0 0 SNAT 0 -- * wan0 10.1.1.0/24
>>> 0.0.0.0/0 to:217.125.139.204
>>>
>>> ==END==
>>>
>>> The problems I have are:
>>> 1) If I make ssh conections from internet to the router (not to any
>>> pc
>>> into the lan zone), sometimes the ssh sesions disconnect.
>>> 2) If I run tcpdump as these:
>>> tcpdump -n -i eth3 not host 80.32.61.58
>>> tcpdump -n -i eth1 not host 217.125.139.204
>>> I can see :
>>> a) IP frames not nated, where the source address is from lan
>>> zone.
>>> b) Source IPs are not the correct.
>>> With tcpdump command I expect don't see anything, instead I can
>>> see
>>> frames as described below.
>>>
>>> Because the wan interface is only 1 (with 2 ip's), I only can use "-j
>>> MASQUERADE" for the nating, I can't use -m physdev --physdev-out,
>>> netfilter layer appears don't know what is the real outgoing interface
>>> in
>>> the bridge wan0 and "wan0:1" is not handled by netfilter layer.
>>>
>>> The questions:
>>> 1) Does anyone know if this is a known issue (the tcpdump output and
>>> physdev issue)?
>>> 2) Does anyone know how to use SNAT in this case (I cant use -j
>>> SNAT)?
>>> 3) With 2.6.19.7 I were using "-m physdev --physdev-out" into the
>>> chain
>>> "MARCAR_IFACE_OUT", but with the 2.6.20.3 updated kernel, the -m
>>> physdev appears to be broken and I then must use -m conntrack. Is this
>>> a good solution?
>>>
>>> Please, I need any help, with this configuration I discovered these
>>> problems but I don't know how to solve them:
>>> 1) wan0 bridge don't appears to be working 100% of time (appears
>>> that
>>> packets from one IP in the bridge are sent to the other interface).
>>> 2) NAT appears to be a bit confused and don't nat all packets,
>>> MASQUERADE don't want to be working all time.
>>> 3) -m physdev --physdev-out don't know what is the read physical
>>> interface where the packets a sent. (Whith 2.6.19.7 kernel, this
>>> extension were working, or, at least, there were counters in the rules.
>>> 4) Conections from internet to the router machine are lost randomly.
>>>
>>> I have no problem to use POSTROUTING chain in nat table to DROP o
>>> REJECT
>>> incorrect packets, but ... really need I to do that?
>>>
>>> Thanks!! All help are apretiated!!
>>>
>>> Regards.
>>>
>>> P.D.: Sorry, my english is a bit poor.
>>>
>>
>>
>>
>>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
|