I would like to route locally-generated traffic:

  • to a TCP port "A" of host "H" via the interface "A",
  • to a TCP port "B" of host "H" via the interface "B".

Interface "B" is sometimes unavailable. Then I would like the kernel to notify the user with "Network is unreachable" error if one tries to connect to the TCP port "B".

I have tried the following settings (when the interface "B" is down):

# iptables -t mangle -nvL OUTPUT
Chain OUTPUT (policy ACCEPT 2 packets, 120 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   120 MARK       all  --  *      *            host-H-ip         MARK set 0x64

(for simplicity the rule does not include ports yet)

# ip rule
0:      from all lookup local 
32765:  from all fwmark 0x64 lookup 200 
32766:  from all lookup main 
32767:  from all lookup default
# ip route show table 200
prohibit default

There are no surprises when the interface "B" is available and the 200 table contains a regular routing rule.

But when the interface "B" is not available I get satisfactory results only for ICMP and UDP:

$ ping host-H-ip
PING host-H-ip (host-H-ip) 56(84) bytes of data.
ping: sendmsg: Network is unreachable

$ nc -nuv host-H-ip 5000
(UNKNOWN) [host-H-ip] 5000 (?) open
too many output retries : Network is unreachable

For TCP it just hangs:

$ nc -nv host-H-ip 5000

I have found some threads that seem to be connected with the topic:

Unfortunately, I still do not understand why I do not get "Network is unreachable" for TCP as well. Could anybody explain it to me?

I am using a 3.16.7-ckt25-1 amd64 kernel.


I have also posted to the netdev mailing list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.