Chapter 11. Netfilter & iproute - marking packets
So far we've seen how iproute works, and netfilter was mentioned a few
times. This would be a good time to browse through Rusty's Remarkably Unreliable Guides. Netfilter itself
can be found here.
Netfilter allows us to filter packets, or mangle their headers. One special
feature is that we can mark a packet with a number. This is done with the
--set-mark facility.
As an example, this command marks all packets destined for port 25, outgoing
mail:
# iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 25 \
-j MARK --set-mark 1 |
Let's say that we have multiple connections, one that is fast (and
expensive, per megabyte) and one that is slower, but flat fee. We would most
certainly like outgoing mail to go via the cheap route.
We've already marked the packets with a '1', we now instruct the routing
policy database to act on this:
# echo 201 mail.out >> /etc/iproute2/rt_tables
# ip rule add fwmark 1 table mail.out
# ip rule ls
0: from all lookup local
32764: from all fwmark 1 lookup mail.out
32766: from all lookup main
32767: from all lookup default |
Now we generate the mail.out table with a route to the slow but cheap link:
# /sbin/ip route add default via 195.96.98.253 dev ppp0 table mail.out |
And we are done. Should we want to make exceptions, there are lots of ways
to achieve this. We can modify the netfilter statement to exclude certain
hosts, or we can insert a rule with a lower priority that points to the main
table for our excepted hosts.
We can also use this feature to honour TOS bits by marking packets with a
different type of service with different numbers, and creating rules to act
on that. This way you can even dedicate, say, an ISDN line to interactive
sessions.
Needless to say, this also works fine on a host that's doing NAT
('masquerading').
IMPORTANT: We received a report that MASQ and SNAT at least collide
with marking packets. Rusty Russell explains it in
this posting. Turn off the reverse path filter to make it work
properly.
Note: to mark packets, you need to have some options enabled in your
kernel:
IP: advanced router (CONFIG_IP_ADVANCED_ROUTER) [Y/n/?]
IP: policy routing (CONFIG_IP_MULTIPLE_TABLES) [Y/n/?]
IP: use netfilter MARK value as routing key (CONFIG_IP_ROUTE_FWMARK) [Y/n/?] |
See also the Section 15.5 in the
Cookbook.