Sorry to ask what is probably a basic question, but I'm struggling to get my routing to do anything sensible. I have simplified by config to the bare minimum to experiment.
Roughly speaking my problem is that I have two interfaces (eth0 and ppp1) and bringing each up individually passes traffic as expected. Setting both up prefers traffic through eth0, likely because of the higher metric. Attempting to set any TC mark to direct traffic through ppp1 and I get no reply packets, netfilter logging suggests it's still trying to pass through eth0 also? $ cat interfaces ############################################################################### #ZONE INTERFACE BROADCAST OPTIONS net eth0 detect net ppp1 detect loc br0 detect routeback,bridge,tcpflags,nosmurfs $ cat providers ############################################################################################ #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS COPY peth0 1 0x10000 main eth0 detect track br0 pppp1 12 0xC0000 main ppp1 - track br0 $ cat tcrules ###################################################################################################################### #MARK SOURCE DEST PROTO DEST SOURCE USER TEST LENGTH TOS CONNBYTES HELPER # PORT(S) PORT(S) 0xC0000 $FW 0.0.0.0/0 ALL $ cat masq ############################################################################################# #INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ eth0 br0 ppp1 br0 $ cat rules #################################################################################################################################################################### #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS # PORT PORT(S) DEST LIMIT GROUP #SECTION ESTABLISHED #SECTION RELATED SECTION NEW # DEBUG: Any from firewall LOG:info $FW any LOG:info any $FW LOG:info any any ACCEPT $FW any ACCEPT any $FW $ shorewall show routing Shorewall 4.4.22.3 Routing at localhost - Sun Aug 21 15:17:48 UTC 2011 Routing Rules 0: from all lookup local 10000: from all fwmark 0x10000/0xff0000 lookup peth0 10011: from all fwmark 0xc0000/0xff0000 lookup pppp1 20000: from 192.168.105.70 lookup peth0 22816: from 10.49.134.86 lookup pppp1 32766: from all lookup main 32767: from all lookup default Table default: Table local: local 10.49.134.86 dev ppp1 proto kernel scope host src 10.49.134.86 broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1 broadcast 192.168.111.0 dev br0 proto kernel scope link src 192.168.111.254 broadcast 192.168.111.255 dev br0 proto kernel scope link src 192.168.111.254 broadcast 192.168.105.0 dev eth0 proto kernel scope link src 192.168.105.70 broadcast 192.168.105.255 dev eth0 proto kernel scope link src 192.168.105.70 local 192.168.111.254 dev br0 proto kernel scope host src 192.168.111.254 broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1 local 192.168.105.70 dev eth0 proto kernel scope host src 192.168.105.70 local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1 local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1 Table main: 192.168.105.1 dev eth0 scope link src 192.168.105.70 10.64.64.65 dev ppp1 proto kernel scope link src 10.49.134.86 192.168.111.0/24 dev br0 proto kernel scope link src 192.168.111.254 192.168.105.0/24 dev eth0 proto kernel scope link src 192.168.105.70 metric 2 127.0.0.0/8 via 127.0.0.1 dev lo default via 192.168.105.1 dev eth0 metric 2 default via 10.64.64.65 dev ppp1 metric 450 Table peth0: 192.168.105.1 dev eth0 scope link src 192.168.105.70 192.168.111.0/24 dev br0 proto kernel scope link src 192.168.111.254 192.168.105.0/24 dev eth0 proto kernel scope link src 192.168.105.70 metric 2 default via 192.168.105.1 dev eth0 src 192.168.105.70 Table pppp1: 10.64.64.65 dev ppp1 proto kernel scope link src 10.49.134.86 192.168.111.0/24 dev br0 proto kernel scope link src 192.168.111.254 default dev ppp1 scope link Symptoms: $ ping 91.220.24.0 ... nothing... $ tail /var/log/messages Aug 21 15:07:04 localhost kern.info kernel: [67553.298873] Shorewall:fw2net:LOG:IN= OUT=eth0 SRC=192.168.105.70 DST=91.220.24.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=34126 SEQ=2 MARK=0xc0000 Aug 21 15:07:04 localhost kern.info kernel: [67553.298941] Shorewall:fw2net:LOG:IN= OUT=eth0 SRC=192.168.105.70 DST=91.220.24.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=34126 SEQ=2 MARK=0xc0000 Aug 21 15:07:05 localhost kern.info kernel: [67554.305747] Shorewall:fw2net:LOG:IN= OUT=eth0 SRC=192.168.105.70 DST=91.220.24.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=34126 SEQ=3 MARK=0xc0000 Aug 21 15:07:05 localhost kern.info kernel: [67554.305815] Shorewall:fw2net:LOG:IN= OUT=eth0 SRC=192.168.105.70 DST=91.220.24.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=34126 SEQ=3 MARK=0xc0000 But.... $ /etc/init.d/net.eth0 stop net.eth0 | * Bringing down interface eth0 net.eth0 | * Stopping dhcpcd on eth0 ... [ ok ] $ ping 91.220.24.20 PING 91.220.24.20 (91.220.24.20): 56 data bytes 64 bytes from 91.220.24.20: seq=0 ttl=55 time=303.160 ms 64 bytes from 91.220.24.20: seq=1 ttl=55 time=306.027 ms 64 bytes from 91.220.24.20: seq=2 ttl=55 time=325.694 ms 64 bytes from 91.220.24.20: seq=3 ttl=55 time=308.614 ms 64 bytes from 91.220.24.20: seq=4 ttl=55 time=305.485 ms $ tail /var/log/messages Aug 21 15:21:28 localhost kern.info kernel: [68416.718263] Shorewall:fw2net:LOG:IN= OUT=ppp1 SRC=10.49.134.86 DST=91.220.24.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=22609 SEQ=0 MARK=0xc0000 Aug 21 15:21:28 localhost kern.info kernel: [68416.718263] Shorewall:fw2net:LOG:IN= OUT=ppp1 SRC=10.49.134.86 DST=91.220.24.20 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=22609 SEQ=0 MARK=0xc0000 What am I missing? Thanks Ed W ------------------------------------------------------------------------------ Get a FREE DOWNLOAD! and learn more about uberSVN rich system, user administration capabilities and model configuration. Take the hassle out of deploying and managing Subversion and the tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2 _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
