I am routing HTTPS connections down a SSH tunnel (-w) using
iptables marks and
iproute2 rules, the reasons I need to do it this way are contrived, to say the least, so most alternate solutions may not work for me at all.
The tun0 device exists and is working as I wish, and routing is working when I apply the MARK in the OUTPUT chain, but for some reason the routing rule appears to not work if the MARK is applied in the FORWARD chain.
The OS is CentOS 6.7 with a 2.6.32 kernel and 1.4.7 iptables.
iptables marking and logging:
# iptables -t mangle -A FORWARD -p tcp --dport 443 -j MARK --set-mark 1 # iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 1 # iptables -t mangle -A POSTROUTING -m mark --mark 1 -j LOG --log-prefix "marked: "
iproute2 rule setup:
# cat 201 tunneled >> /etc/iproute2/rt_tables # ip rule add fwmark 1 table tunneled # ip route add default via 192.168.100.1 dev tun1 table tunneled
And a small section from the log to show results:
Feb 17 19:11:35 nhopm kernel: marked: IN= OUT=eth0 SRC=192.168.82.2 DST=188.8.131.52 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=16734 DF PROTO=TCP SPT=34619 DPT=443 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x1 Feb 17 19:12:00 nhopm kernel: marked: IN= OUT=tun1 SRC=192.168.81.8 DST=184.108.40.206 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=62747 DF PROTO=TCP SPT=55349 DPT=443 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x1
The host has 2 NICs
eth0 is 192.168.81.8 with 192.168.81.1 being the default gateway and
eth1 192.168.82.8 which acts as the default gateway for 192.168.82.0/24 - there are no issues with this setup, it works as expected. The tunnel tun0 has 192.168.100.1 on its far end.
I have tried to narrow this down to the simplest situation that illustrates the issue without overwhelming with details, but will provide as much detail as is deemed necessary to try to find where the problem lays please ask for anything that could be helpful in comments. Hopefully I have just misunderstood some small part of how this works.
My attempt to do the above was based on this
iptables flow diagram:
Which hides the fact that the same set of Routing Decision are not applied to packets coming from the OUTPUT chain as those coming from the FORWARD chain.
To make this work I needed to replace the marking done in the FORWARD chain with a similar entry in the the PREROUTING chain.
iptables -t mangle -A PREROUTING -p tcp --dport 443 ! -d 192.168.0.0/16 -j MARK --set-mark 1
Which actually suits my needs a bit better anyway.
I'm not making this an answer (yet) though as I still have not found documentation of this - if I do I shall provide an answer, unless someone beats me to it.