I am routing HTTPS connections down a SSH tunnel (-w) using iptables marks and iproute2 rules, the reasons I need to do it this way are contrived, to say the least, so most alternate solutions may not work for me at all.

The tun0 device exists and is working as I wish, and routing is working when I apply the MARK in the OUTPUT chain, but for some reason the routing rule appears to not work if the MARK is applied in the FORWARD chain.

The OS is CentOS 6.7 with a 2.6.32 kernel and 1.4.7 iptables. The iptables marking and logging:

# iptables -t mangle -A FORWARD -p tcp --dport 443 -j MARK --set-mark 1 
# iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 1 
# iptables -t mangle -A POSTROUTING -m mark --mark 1 -j LOG --log-prefix "marked: "

The iproute2 rule setup:

# cat 201 tunneled >> /etc/iproute2/rt_tables
# ip rule add fwmark 1 table tunneled
# ip route add default via dev tun1 table tunneled

And a small section from the log to show results:

Feb 17 19:11:35 nhopm kernel: marked: IN= OUT=eth0 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=16734 DF PROTO=TCP SPT=34619 DPT=443 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x1 
Feb 17 19:12:00 nhopm kernel: marked: IN= OUT=tun1 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=62747 DF PROTO=TCP SPT=55349 DPT=443 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x1 

The host has 2 NICs eth0 is with being the default gateway and eth1 which acts as the default gateway for - there are no issues with this setup, it works as expected. The tunnel tun0 has on its far end.

I have tried to narrow this down to the simplest situation that illustrates the issue without overwhelming with details, but will provide as much detail as is deemed necessary to try to find where the problem lays please ask for anything that could be helpful in comments. Hopefully I have just misunderstood some small part of how this works.


My attempt to do the above was based on this iptables flow diagram: from iptables.info

Which hides the fact that the same set of Routing Decision are not applied to packets coming from the OUTPUT chain as those coming from the FORWARD chain.

To make this work I needed to replace the marking done in the FORWARD chain with a similar entry in the the PREROUTING chain.

iptables -t mangle -A PREROUTING -p tcp --dport 443 ! -d -j MARK --set-mark 1

Which actually suits my needs a bit better anyway.

I'm not making this an answer (yet) though as I still have not found documentation of this - if I do I shall provide an answer, unless someone beats me to it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.