I have a problem! So, I have two providers and a routing server on CentOS7. I can not get the marking to work through the second provider. The essence is this: With the first provider everything is fine, it is not highlighted in a separate table. A simple rule for MASQUERADE and a rule for a firewall.
iptables -t nat -I POSTROUTING -s MY_IP -j MASQUERADE
iptables -I RH-Firewall-1-INPUT -m mac --mac-source MY_MAC -j ACCEPT
The second provider sits in a separate table, in the table itself there is only the default route and a couple of rules:
ip route show table 2
default via GATEWAY_OF_PROVIDER dev eth2.2
ip rule show
from GATEWAY_OF_PROVIDER lookup 2
from all fwmark 0x2 lookup 2
Outcome: If I add a rule:
ip rule add from MY_IP lookup 2
, then everything works, and if I add
iptables -t mangle -I PREROUTING -s MY_IP -j MARK --set-mark 2
, everything breaks at the provider's gateway.
trace with manual rule:
1 <1 мс <1 мс <1 мс gate.dtbyh.ru [192.168.0.XX]
2 <1 мс <1 мс <1 мс ipXXX.XXX.XXX.XXX.ipblk.stnsk.ru [195.189.218.73]
3 1 ms 1 ms <1 мс gw.stnsk.ru [XX.XX.XX.XX]
4 1 ms 1 ms 1 ms startel-gw.mega-com.ru [XXX.XX.XX.XX]
5 1 ms 1 ms 1 ms kuchum-xe-0-0-2.yndx.net [XX.XX.XX.XX]
6 46 ms 61 ms 50 ms sverdlov-xe-0-0-3.yndx.net [213.180.213.68]
7 46 ms 46 ms 46 ms styri-et-10-3-0-901.yndx.net [213.180.213.18]
8 63 ms 47 ms 47 ms m9-p2-eth-trunk8.yndx.net [87.250.239.127]
trace with mark rule:
1 <1 мс <1 мс <1 мс gate [192.168.0.XX]
2 * <1 мс <1 мс ipXXX.XXX.XXX.XXX.ipblk.stnsk.ru [XX.XXX.XXX.XX]
3 * * *
4 * * *
ie the marking is work, but it does not let go of the gateway.
sysctl:
net.ipv4.conf.default.accept_source_route = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
Thank you!
