I would like to route locally-generated traffic:
- to a TCP port "A" of host "H" via the interface "A",
- to a TCP port "B" of host "H" via the interface "B".
Interface "B" is sometimes unavailable. Then I would like the kernel to notify the user with "Network is unreachable" error if one tries to connect to the TCP port "B".
I have tried the following settings (when the interface "B" is down):
# iptables -t mangle -nvL OUTPUT Chain OUTPUT (policy ACCEPT 2 packets, 120 bytes) pkts bytes target prot opt in out source destination 2 120 MARK all -- * * 0.0.0.0/0 host-H-ip MARK set 0x64
(for simplicity the rule does not include ports yet)
# ip rule 0: from all lookup local 32765: from all fwmark 0x64 lookup 200 32766: from all lookup main 32767: from all lookup default
# ip route show table 200 prohibit default
There are no surprises when the interface "B" is available and the 200 table contains a regular routing rule.
But when the interface "B" is not available I get satisfactory results only for ICMP and UDP:
$ ping host-H-ip PING host-H-ip (host-H-ip) 56(84) bytes of data. ping: sendmsg: Network is unreachable $ nc -nuv host-H-ip 5000 (UNKNOWN) [host-H-ip] 5000 (?) open foo too many output retries : Network is unreachable
For TCP it just hangs:
$ nc -nv host-H-ip 5000
I have found some threads that seem to be connected with the topic:
Unfortunately, I still do not understand why I do not get "Network is unreachable" for TCP as well. Could anybody explain it to me?
I am using a 3.16.7-ckt25-1 amd64 kernel.
I have also posted to the netdev mailing list.