similar to: [Bug 968] New: CONNMARK failing open silently?

Hello everybody. i have the folowing problem: i have this in the top of PREROUTING chain in mangle table iptables -t mangle -A PREROUTING -j CONNMARK --set-mark 0 # rule 1 iptables -t mangle -A PREROUTING -m connmark --mark 5 # rule 2 iptables -t mangle -A PREROUTING -m connmark --mark 6 # rule 3 i think when packet is passing trough my POSTROUTING in mangle table

-----Original Message----- From: Salim S I [mailto:salim.si@cipherium.com.tw] Sent: Thursday, May 10, 2007 5:22 PM To: ''Francis Brosnan Blazquez'' Subject: RE: [LARTC] Load balancing using connmark "I think the main advantage of shorewall solution is that it applies connmark to incoming packets from the wan as you point, leaving load balancing to outgoing connections to the

I saw this snippet from Daniel Chemko dchemko@smgtec.com Mon, 31 May 2004 09:30:43 -0700 # Egress marking (mostly for QOS operations) iptables -t mangle -A POSTROUTING -j CONNMARK --restore-mark iptables -t mangle -A POSTROUTING -m mark ! --mark 0 -j ACCEPT iptables -t mangle -A POSTROUTING -o ${if_inet} --dport 21 -j MARK --set-mark 0x111 iptables -t mangle -A POSTROUTING -j CONNMARK

I am trying to get IPP2P working on my router. Thus far I can see connections being marked (see below), but they don''t seem to get saved or something. When looking at /proc/net/ip_conntrack, nothing has anything other than 0 for mark. The iptables commands for this are: iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j

Hi, I want to classify with ipp2p packets that I''ve captured with tcpdump. I send the packets with tcpreply. I had to create a bridge interface in order to enable the listening interface in promiscous mode and to classify the traffic mirrored to that. In this mode the traffic pass through the prerouting chain of the mangle table (on bridge). I want to used connmark for recognized flows,

What are the pros and cons of using CONNMARK along with the Multiple ISP Links and Load Balancing method as suggested in the HOWTO and with Julian''s patches for Dead Gateway Detection ? I have been observing excellent results without the CONNMARK rules. How is the performance affected if CONNMARK is used ? Thanks, Manish

Hi, I'm running CentOS 4 with most of the latest updates, but am having trouble with iptables and the CONNMARK target. Is it available in the CentOS 4 kernel? Running on i386: kernel: 2.6.9-67.0.4.ELsmp iptables: v1.2.11 # iptables -t mangle -A PREROUTING -j CONNMARK --set-mark 1 iptables: No chain/target/match by that name I see I do have the CONNMARK lib in

https://bugzilla.netfilter.org/show_bug.cgi?id=1128 Bug ID: 1128 Summary: ip6_tables connmark or connlabel never matches Product: netfilter/iptables Version: unspecified Hardware: x86_64 OS: SuSE Linux Status: NEW Severity: normal Priority: P5 Component: ip6_tables (kernel)

Hi there, i have some questions regarding CONNMARK and STRING modules for netfilter. I have a stateful firewall doing contraking, because i have two dsl connections doing load balancing. I have found a way to discriminate KaZaA traffic flowing via port 80 from normal HTTP traffic using the string match. I want to mark a kazaa connection and filter ir to a specific qdisc. I have been looking

Hello Everyone, I'm making an load balance ,on output packages IP from my firewall to Internet, with netfilter connmark and statistic match modules. it's necessary those two modules togethers to do the load balance on connection state. well I'm using CentOS 5.6 and I've searching on Internet but haven't found any package RPM that.this package come with iptables 1.4.x version

Hi, as per the shorewall MultiISP documentation ( http://www1.shorewall.net/MultiISP.html ), it says "Use of this feature requires that your kernel and iptables include CONNMARK target and connmark match support (Warning: Standard Debian™ and Ubuntu™ kernels are lacking that support!)." it means MultiISP wont work properly if i am using Ubuntu server. if yes whats the

Hi, I''ve been implementing a load balancing solution using CONNMARK, based on solution described by Luciano Ruete at [1]. Gracias por el post y por apuntar en la dirección correcta Luciano! Once implemented, I''ve found that due to some reason packets aren''t properly marked (or improperly remarked) and sent out using the wrong interface. My topo setup is:

Hello! Maybe someone needs connmark and connbytes working together? See attached file compatible with pom-ng-20040621 (I called it connmarkbytes :)). Kind Regards, Tomasz Chilinski

Hi All, It''s an old problem and still isn''t fixed :( I need the connection marking support to enable the triplet of ISP''s we use. However, I downloaded the latest 2.6.22.1 kernel, made an RPM and installed it. I see the following kernel modules (which looks promising): /lib/modules/2.6.22.1/kernel/net/netfilter xt_connmark.ko xt_CONNMARK.ko Which yields the

Hi all, and thx for all previous repplies to my questions!!! Here is another one bit trouble: is it possible maintain commark information after that a packet crossed the forwarding chain with masquerading? Best wishes, Diego -- Diego Giardinetto Skype Name: cpuzorro MSN: cpuoverload@hotmail.it

Hello I''m trying to switch from IMQ to IFB but I have a problem with traffic marked by ipp2p module. Looks like when traffic is redirected from ethX to ifbX it looses information about MARK. Here''s what I do to get ingress traffic to go to ifb interface: $TC qdisc add dev eth1.42 ingress $TC filter add dev eth1.42 parent ffff: protocol ip prio 10 u32 \ match u32 0 0

Hi.... I''m trying to setup a LAN router with P2P filter but the problem is that can''t "catch" Ares. There is a way to DROP "ares" p2p packets ? I''ve tried with last "ipp2p" snapshot without sucess... I''ve Kernel 2.4.28 iptables 1.3.0 Various Patches from patch-o-matic-ng-20040621 iproute2-ss020116 IMQ Patch Esfq Patch

I am trying to apply the new :T flag in tcrules. the man page for this file [1] sayas that if SOURCE is $FW then rules are applied in OUTPUT. this doesn''t seem to work on my setup. I have in tcrules : ------------------------------------------------------------------------ RESTORE:T 0.0.0.0/0 0.0.0.0/0 all - - - 0 CONTINUE:T 0.0.0.0/0 0.0.0.0/0

Hi All Take a look and please tell what is wrong: root@prensa:~# $IPT -t mangle -F PREROUTING root@prensa:~# $IPT -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables: No chain/target/match by that name root@prensa:~# $IPT -t mangle -A PREROUTING -j CONNMARK iptables v1.3.4: CONNMARK target: No operation specified Try `iptables -h'' or

http://bugzilla.netfilter.org/show_bug.cgi?id=712 Summary: iptables-save does not save correcly rateest bps parameter Product: iptables Version: unspecified Platform: x86_64 OS/Version: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: unknown AssignedTo: