1 |
On 2013-10-04, Grant Edwards <grant.b.edwards@×××××.com> wrote: |
2 |
> On 2013-10-04, Grant Edwards <grant.b.edwards@×××××.com> wrote: |
3 |
>> On 2013-10-04, Kerin Millar <kerframil@×××××××××××.uk> wrote: |
4 |
>>> On 04/10/2013 21:55, Grant Edwards wrote: |
5 |
>> |
6 |
>>>> I then add an iptables rule like this: |
7 |
>>>> |
8 |
>>>> iptables -A OUTPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 1 |
9 |
>> |
10 |
>> I'm about to try adding a second iptables rule to us the nat table to |
11 |
>> rewrite the source IP address. Something like this: |
12 |
>> |
13 |
>> iptables -A POSTROUTING -t nat -o net2 -m mark --mark 1 -j SNAT --to 172.16.1.2 |
14 |
> |
15 |
> I also tried |
16 |
> |
17 |
> iptables -A POSTROUTING -t nat -o net2 -p tcp --dport 80 -j SNAT --to 172.16.1.2 |
18 |
> |
19 |
> [I don't think the second rule is quite right, though, since it will |
20 |
> also match packets that _don't_ need to have the source IP |
21 |
> re-written.] |
22 |
> |
23 |
> Both produced the same results: outbound packets look correct (they |
24 |
> have a source address that's valid for the net2 interface). But, |
25 |
> inbound packets don't seem to reach the TCP stack: |
26 |
|
27 |
If I disable reverse-path filtering then it works. [I'm using the |
28 |
first SNAT rule that matches based on the mark], but I don't really |
29 |
like disabling all the reverse path filtering. |
30 |
|
31 |
Is there a cleaner way to accomplish this that doesn't fall afoul of |
32 |
rp_filter? |
33 |
|
34 |
-- |
35 |
Grant Edwards grant.b.edwards Yow! I have accepted |
36 |
at Provolone into my life! |
37 |
gmail.com |