Re: [BUG / question] in routing rules, some options (e.g. ipproto, sport) cause rules to be ignored in presence of packet marks

[Michal Soltys]

On 3/28/21 4:05 PM, Michal Soltys wrote:

Hi,

iptables -t mangle -A OUTPUT -j MARK --set-mark 1

iptables -t mangle -A OUTPUT -j TOS --set-tos 0x02



Anyway, I've attached 2 scripts setting up namespace with all those cases.

- run setup-host.sh
- then in the namespace: run setup-namespace.sh
- fire up another bash in ns with tcpdump on right1

nc -u -p 1194 1.2.3.4 12345



Now add in the namespace:

iptables -t mangle -A OUTPUT -j MARK --set-mark 1

or

iptables -t mangle -A OUTPUT -j TOS --set-tos 0x02

After some extra checks, the exact same issue happens if we mangle tos instead of mark, so ... ... will cause same routing issues with incorrect output interface being set. This will work fine, as the packet will be routed correctly via right2, tcpdump will show nothing Same nc as above - now the packet will go out via right1, using right2's address (initial routing decision). Unrelated issue - while doing the tests I noticed that routing rules based on tos have no effect at all for locally generated packets. Will make another post about it though.

setup-namespace.sh
Description: application/shellscript

setup-host.sh
Description: application/shellscript