Share your knowledge at the LQ Wiki.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 03-06-2008, 05:46 PM   #1
Registered: Jun 2002
Distribution: Ubuntu
Posts: 31

Rep: Reputation: 16
Question on copying iptables CONNMARK to netfilter MARK


I'm having a problem transferring iptables connection tracking (conntrack) marks to Netfilter marks. I'm trying to use the 'conntrack' tool (from conntrack-tools) to update conntrack mark values on ESTABLISHED connections, then use iptables to monitor those mark values via the connmark module and transfer the mark values to the packet as it is handed off to Netfilter. A tc filter exists which is supposed to look for packets with certain fwmark's, and drop them into their corresponding qdisc.

Here are the rules I'm using:

-t mangle -A POSTROUTING -j CONNMARK --restore-mark
-t mangle -A POSTROUTING -m connmark --mark 0x5 -j MARK --set-mark 0x5
-t mangle -A POSTROUTING -j CONNMARK --save-mark
qdisc add dev eth0 root handle 1: prio
qdisc add dev eth0 parent 1:2 handle 12: htb
filter add dev eth0 parent 12: protocol ip prio 1 handle 5 fw flowid 12:5

class add dev eth0 parent 12: classid 12:5 htb rate 56kbit
qdisc add dev eth0 parent 12:5 handle 5: sfq perturb 10
iptables -t mangle -L -v shows packets matching the rules, but the tc qdisc counters for 12:5 are not incrementing, which would show packets are entering the qdisc.

I've tried to do some debugging by MARKing all packets for a single host in iptables, but even that gives me some problems.

This doesn't work:
-t mangle -A POSTROUTING -s -j MARK --set-mark 5
But this does:

$IPSET --create testhost nethash
$IPSET --add testhost

-t mangle -A POSTROUTING -m set --set testhost src -j MARK --set-mark 5
Obviously there's something that I don't understand about iptables and/or netfilter. Any help would be greatly appreciated.
Old 03-06-2008, 06:13 PM   #2
Registered: Feb 2008
Location: Texas
Distribution: Fedora, RHEL, CentOS
Posts: 488

Rep: Reputation: 78
you are doing it on the POSTROUTING mangle chain. Wouldn't you want to do this before your routing decisions occur (by using PREROUTING mangle chain)?

Chapter 6. Traversing of tables and chains
Old 03-06-2008, 06:27 PM   #3
Registered: Jun 2002
Distribution: Ubuntu
Posts: 31

Original Poster
Rep: Reputation: 16
I forgot to mention I'm using this on a bridge, not a router.

This machine runs L7-Filter. The documentation for that software recommends modifying the MARK value in the POSTROUTING chain. I'm not sure if I need to follow this in my particular situation, but I did.

I've tried using the same rules in the PREROUTING and FORWARD chains, but it didn't seem to make a difference. Again, the packets seem to be matching in iptables but fail to match in tc.

I'll read through the link you provided, and post back with any new developments.
Old 03-10-2008, 05:26 PM   #4
Registered: Jun 2002
Distribution: Ubuntu
Posts: 31

Original Poster
Rep: Reputation: 16
I haven't been able to get these MARK values to transfer. I have resorted to using the CLASSIFY target to queue traffic based on its CONNMARK. I hadn't thought of this before because the iptables(8) mentions this works with CBQ queues, although it apparently also works with HTB, which is what I'm using.

For the curious, here's the rule I have resorted to.

-t mangle -A POSTROUTING -m conntrack --ctstate ESTABLISHED,RELATED --ctstatus ASSURED -m connmark --mark 5 -j CLASSIFY --set-class 12:5
Old 06-19-2008, 07:24 AM   #5
Senior Member
Registered: May 2004
Location: Leipzig/Germany
Distribution: Arch
Posts: 1,687

Rep: Reputation: 54
it is done with:
...-j CONNMARK --save-mark
and you (re)use it with:
...-j CONNMARK --restore-mark


iptables, mark, netfilter

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables mark question paulos Linux - Networking 0 01-21-2004 07:20 AM
Netfilter / IPtables SWAT Linux - Newbie 3 11-11-2003 09:04 AM
Netfilter/iptables on Linux Debra Programming 1 10-03-2002 07:40 PM
Netfilter/iptables on Linux Debra Linux - Newbie 0 10-03-2002 06:33 PM
Firewall, netfilter, iptables...? snowbaby Linux - Security 9 08-13-2002 03:22 AM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:10 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration