LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-06-2010, 09:57 AM   #1
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Rep: Reputation: 11
Smile Mark all incoming packets on connection


Hi All,

I have found a few articles and tutorials which seem to do what I need but can't seem to get them to work.

My Setup :

I have a router which makes two ppp connections. PPP0 is my default route and is an uncapped ADSL. PPP1 is a Local Only (South Africa) account which has DNS resolving to its IP. PPP1 allows certain connections in. I want all packets coming in on PPP1 to be marked so that after they have been routed through our local servers they can go back out over PPP1.

Both connections use dynamically assigned ip addresses. I want to use PPP0 to make a connection to one of our stores, but when our stores connect to us they will be using PPP1. All packets from these incoming connections will need to be routed back over PPP1.

Hope that makes sense. If anything is unclear please ask.

Your assistance would be greatly appreciated.

Regards

Andrew Higgs
 
Old 04-06-2010, 11:52 AM   #2
bakdong
Member
 
Registered: Apr 2009
Posts: 214

Rep: Reputation: 44
That's quite a set up! Have you looked at the LARTC site (Linux Advanced Routing and Traffic Control) It has something similar there that you could probably adapt.
 
Old 04-07-2010, 07:08 AM   #3
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Hi Bakdong,

I have looked at these examples and similar ones. But they all seem to be doing Load Balancing and not quite what I am doing (trying to do).

I need to mark all incoming packets. These packets are then redirected to a local machine. When they come back to the router they need to go back out on the original incoming interface (and not the default route). Not sure if I am missing something but I can't seem to get it to work.

I will experiment a little more and maybe post a script later for people to look at. Perhaps this will help.

Regards
 
Old 04-07-2010, 11:49 PM   #4
bakdong
Member
 
Registered: Apr 2009
Posts: 214

Rep: Reputation: 44
It's definitely there. You will need a combination of ip rule tables, iptables to mark the packets, and conntrack. The load balancing part swaps the default route periodically with an optional weighting scheme. You don't have to incorporate that if you don't want it.
 
Old 04-08-2010, 03:35 AM   #5
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Hi Bakdong,

Thanks for the reply.

My ASCII art sucks but here goes. This is a diagram of the network:

Code:
mail----+
        |                                      +-----------------+
        |                                      |                 |
        |               +------------ppp0------+       I         +--------store1
        |               |                      |       N         |
        |           +--------------+           |       T         |
        |           |              |           |       E         | 
user1---+-----------+ router (vpn) |           |       R         |
        |           |              |           |       N         |
        |           +--------------+           |       E         |
        |               |                      |       T         |
        |               +------------ppp1------+                 +--------store2
        |                                      |                 |
        |                                      +-----------------+
user2---+
I want user1 and user2 to be able to make a connection to store1 and store2 using ppp0. In other words if the connection is initiated from the local network it should be routed over the default gateway (ppp0). This is easy to do.

The problem comes in when store1 or store2 make a connection to the mail server. They connect via ppp1 (their is a dns resolvable name on this connection which I can't have on ppp0). The packets from this connection are then redirected to mail. When mail routes back to the store, the default gateway is used and the connection is broken. The solution to this is add a route to allow traffic to store1 and store2 to go via ppp1, but then all connections from inside the local network are also affected.

So I am thinking I need to mark all new incoming connections on ppp1 so that they can be routed back to ppp1 later. What I have tried so far is this :
Code:
#!/bin/sh

/usr/bin/echo 1 > /proc/sys/net/ipv4/ip_dynaddr
/usr/bin/echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

/usr/sbin/iptables-restore firewall.rules

/sbin/ip rule del from all fwmark 1 2>/dev/null
/sbin/ip rule del from all fwmark 2 2>/dev/null
/sbin/ip rule add fwmark 1 table Uncapped
/sbin/ip rule add fwmark 2 table LocalOnly
/sbin/ip route flush cache

# THESE TWO LINES WILL BE SET IN IP_UP

#/sbin/ip route add table Uncapped default dev ppp0
#/sbin/ip route add table LocalOnly default dev ppp1
The file firewall.rules referred above includes the following in it's mangle section :
Code:
*mangle
:PREROUTING ACCEPT [81132:42738999]
:INPUT ACCEPT [16988:5371568]
:FORWARD ACCEPT [64012:37349459]
:OUTPUT ACCEPT [12841:2317402]
:POSTROUTING ACCEPT [76837:39665453]
-N Uncapped
-A Uncapped -j MARK --set-mark 1
-A Uncapped -j CONNMARK --save-mark
-N LocalOnly
-A LocalOnly -j MARK --set-mark 2
-A LocalOnly -j CONNMARK --save-mark
-A PREROUTING -i eth1 -p tcp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
-A PREROUTING -i ppp1 -p tcp -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j LocalOnly
COMMIT
What am I doing wrong? How does all of this affect the main routing table?

Regards

Andrew Higgs
 
Old 04-08-2010, 03:53 AM   #6
zhjim
Senior Member
 
Registered: Oct 2004
Distribution: Debian Squeeze x86_64
Posts: 1,436
Blog Entries: 11

Rep: Reputation: 181Reputation: 181
If the stores trying to connect to the mail server and from there back to them over ppp1 why not just have all the packets coming from the mail server go through ppp1?
 
Old 04-08-2010, 07:19 AM   #7
bakdong
Member
 
Registered: Apr 2009
Posts: 214

Rep: Reputation: 44
You've got no pref numbers in your ip rule statements. Not sure that's the problem though. What's the output of :

ip rule
ip route show table Uncapped/Localonly
 
Old 04-08-2010, 08:40 AM   #8
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Quote:
Originally Posted by zhjim View Post
If the stores trying to connect to the mail server and from there back to them over ppp1 why not just have all the packets coming from the mail server go through ppp1?
I must truly be missing something simple here. Or I really don't understand something. I have simplified the solution as above. Thanks it is a very good suggestion.

Here are my scripts to hopefully achieve the above :

mangle has been stripped to the following:
Code:
*mangle
:PREROUTING ACCEPT [81132:42738999]
:INPUT ACCEPT [16988:5371568]
:FORWARD ACCEPT [64012:37349459]
:OUTPUT ACCEPT [12841:2317402]
:POSTROUTING ACCEPT [76837:39665453]
-N LocalOnly
-A LocalOnly -j MARK --set-mark 2
-A LocalOnly -j CONNMARK --save-mark
-A PREROUTING -i eth1 -s 172.16.48.200 -p tcp -m state --state ESTABLISHED,RELATED -j LocalOnly
COMMIT
Store1 (196.210.xxx.xxx) and Store2 (196.215.xxx.xxx) are both able to make their connections as expected while the main routing table has their routes set to ppp1. To test I thought I would activate the mangling in the firewall and remove Store2's (route del -net 196.215.0.0/16) main routing entry. When I do this Store1 remains connected but Store2 loses it's connection.

What am I missing? If my hair was longer I would be pulling it out. :-)

Regards

Andrew Higgs
 
Old 04-08-2010, 08:47 AM   #9
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Quote:
Originally Posted by bakdong View Post
You've got no pref numbers in your ip rule statements. Not sure that's the problem though. What's the output of :

ip rule
ip route show table Uncapped/Localonly
What exactly is the pref number? Is it not 1 for Uncapped and 2 for LocalOnly?

The output of ip rule :
Code:
0:	from all lookup local 
32764:	from all fwmark 0x2 lookup LocalOnly 
32765:	from all fwmark 0x1 lookup Uncapped 
32766:	from all lookup main 
32767:	from all lookup default
The output of ip route show table LocalOnly:
Code:
default dev ppp1  scope link
The output of ip route show table Uncapped:
Code:
default dev ppp0  scope link
Thanks.

Regards

Andrew Higgs
 
Old 04-08-2010, 12:47 PM   #10
bakdong
Member
 
Registered: Apr 2009
Posts: 214

Rep: Reputation: 44
Ok, so it's nothing to do with the pref number (32764-7 in your case) I can't see why it's not working. Sorry.
 
Old 04-08-2010, 12:56 PM   #11
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Smile

Quote:
Originally Posted by bakdong View Post
Ok, so it's nothing to do with the pref number (32764-7 in your case) I can't see why it's not working. Sorry.
Thanks for the assistance. I appreciate the effort you put into trying to help me out.
 
Old 04-09-2010, 03:02 AM   #12
zhjim
Senior Member
 
Registered: Oct 2004
Distribution: Debian Squeeze x86_64
Posts: 1,436
Blog Entries: 11

Rep: Reputation: 181Reputation: 181
Maybe something like this will settle the dust.

Code:
ip rule add from mail.server.i.p to sto.re.1.ip table LocalOnly
ip rule add from mail.server.i.p to sto.re.2.ip table LocalOnly
This would prevent you from marking. If this does not suite I guess we best start from scratch?
 
Old 04-09-2010, 03:20 AM   #13
bakdong
Member
 
Registered: Apr 2009
Posts: 214

Rep: Reputation: 44
Stabbing in the dark now.... do you have specific routes defined in the main table? If you have, wouldn't these take priority over the default routes?
 
Old 04-09-2010, 04:49 AM   #14
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Quote:
Originally Posted by zhjim View Post
Maybe something like this will settle the dust.

Code:
ip rule add from mail.server.i.p to sto.re.1.ip table LocalOnly
ip rule add from mail.server.i.p to sto.re.2.ip table LocalOnly
This would prevent you from marking. If this does not suite I guess we best start from scratch?
Thanks zhjim.

I have no problem with not needing to mark packets. In fact the simpler the solution the better. :-)

I have reset my firewall to remove all marking etc. I have flushed all rules relating to marking. This is what ip rule puts out now :
Code:
0:	from all lookup local 
32763:	from 172.16.48.200 lookup LocalOnly 
32766:	from all lookup main 
32767:	from all lookup default
My main routing table still contains routes which send packets destined for 196.210.0.0 and 196.215.0.0 to ppp1. I assume these should be removed. If I do this routing to those ip addresses goes through the default gateway. :-(

What should be in ip route show table LocalOnly? This is what it currently has in it :
Code:
default dev ppp1  scope link
Should there be anything else? If I can have a purely routing solution (i.e. no change to the firewall) all the better.

Thanks again.

Regards

Andrew
 
Old 04-09-2010, 04:53 AM   #15
andrewhiggs
LQ Newbie
 
Registered: Apr 2010
Location: ZA
Distribution: Slackware 13, Ubuntu 9.10
Posts: 21

Original Poster
Rep: Reputation: 11
Quote:
Originally Posted by bakdong View Post
Stabbing in the dark now.... do you have specific routes defined in the main table? If you have, wouldn't these take priority over the default routes?
Thanks bakdong,

Yes. The main routing table routes all packets destined for 196.210.0.0 and 196.215.0.0 to ppp1. The end goal is to have these removed so that connections initiated from our internal network (i.e. user1 and user2) are routed via ppp0.

Regards

Andrew
 
  


Reply

Tags
filtering, packet, routing


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
check incoming or outgoing packets ilnli Programming 1 07-24-2007 03:08 PM
Incoming and outgoing traffic (packets) increased tooparam General 4 09-22-2006 01:20 PM
logging incoming packets ip address b123coder Linux - Networking 1 11-18-2004 02:17 PM
drop incoming/outgoing packets using iptables doshiaj Linux - Security 1 06-08-2004 10:38 AM
Red Hat 9 eth0 not accepting incoming packets. BinkyTheOracle Linux - Networking 21 01-25-2004 02:28 PM


All times are GMT -5. The time now is 11:48 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration