--=-k0nP3Dr93SinCmuHMNaA Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I have a router with 2 isp's connected. My default route is by isp1, and i mark packets to port 80 and port 21 with mark 2. with: ip rule ls 0: from all lookup local=20 32765: from all fwmark 2 lookup 200=20 32766: from all lookup main=20 32767: from all lookup 253=20 and in table 200 i have the route by isp2. My http traffic goes well, but ftp doesn't. Using Passive mode all works well, but with active it doest work, because the ftp server callsback with port 20. Please note that isp2 is masqueraded and i have ip_conntrack_ftp in the kernel. Thanks for any advice. Nuno Fernandes --=20 Nuno Miguel Pais Fernandes <npf@eurotux.com> Eurotux S.A. --=-k0nP3Dr93SinCmuHMNaA Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQA93PbKbJtoPy2XRQkRAoYFAJ9EQIZTU0Kud3fLyUgScHzSHh7jMgCfXvBA 9qOJ7u7H1Nflh9+QOHix7m8= =680Y -----END PGP SIGNATURE----- --=-k0nP3Dr93SinCmuHMNaA--
I believe you can use the "helper" module: http://www.iptables.org/documentation/pomlist/pom-submitted.html#helper and mark the related packets like so: iptables -t mangle -A PREROUTING -m helper --helper ftp -j MARK --set-mark 2 This is just an idea and I have not tested this solution personally. Ramin On Thu, Nov 21, 2002 at 03:07:54PM +0000, Nuno Miguel Pais Fernandes wrote: > I have a router with 2 isp's connected. > > My default route is by isp1, and i mark packets to port 80 and port 21 > with mark 2. > > with: ip rule ls > > 0: from all lookup local > 32765: from all fwmark 2 lookup 200 > 32766: from all lookup main > 32767: from all lookup 253 > > and in table 200 i have the route by isp2. > > My http traffic goes well, but ftp doesn't. > Using Passive mode all works well, but with active it doest work, > because the ftp server callsback with port 20. > Please note that isp2 is masqueraded and i have ip_conntrack_ftp in the > kernel. > > Thanks for any advice. > > Nuno Fernandes > > > -- > Nuno Miguel Pais Fernandes <npf@eurotux.com> > Eurotux S.A.
On Thursday 21 November 2002 16:07, Nuno Miguel Pais Fernandes wrote: > I have a router with 2 isp's connected. > > My default route is by isp1, and i mark packets to port 80 and port 21 > with mark 2. > > with: ip rule ls > > 0:=09from all lookup local > 32765:=09from all fwmark 2 lookup 200 > 32766:=09from all lookup main > 32767:=09from all lookup 253 > > and in table 200 i have the route by isp2. > > My http traffic goes well, but ftp doesn't. > Using Passive mode all works well, but with active it doest work, > because the ftp server callsback with port 20. You can use the iptables helper to mark all the ftp packets. Even the ac= tive=20 ftp packets if they use a dynamic port. Stef --=20 stef.coene@docum.org "Using Linux as bandwidth manager" http://www.docum.org/ #lartc @ irc.oftc.net