* [LARTC] owner based policy routing
@ 2002-10-11 4:16 Arindam Haldar
2002-10-11 21:30 ` Jose Luis Domingo Lopez
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Arindam Haldar @ 2002-10-11 4:16 UTC (permalink / raw
To: lartc
hi all,
THE SCENARIO:
we are connected to 2 isp, both having their large network.. isp A has
gateway with ofc network while ispB has satellite gateway & hence there
are advantages to take specific routes thru specific isp.
PRESENT IMPLEMENTATION:
the present linux box with kernel-2.4.19, julains multiroute patch,
iproute-ss020116, htb3.6-020525 & iptables-1.2.7a... this box has 5
ether ports & presently doing only **source** based policy routing for
access to internet...at present no squid is implemented in this box...
things are working good for last 40-45 days !
THE RULES DEFINED:
10:
from all lookup main
50: from <ipNetispA> lookup ispA
50: from all fwmark 50 lookup ispA
75: from <ipNetispB> lookup ispB
75: from all fwmark 75 lookup GNFC
100: from <localNetA> lookup balance
100: from <localNetB> lookup balance
100: from <localNetC> lookup balance
100: from all fwmark 100 lookup balance
32766: from all lookup main
32767: from all lookup default
THE ROUTES:
[root@ICG surfNet]# ip route ls ta ispA
default via <gatewayISP-A> dev eth3 proto static src <eth3ISP-A>
prohibit default proto static metric 1
[root@ICG surfNet]# ip route ls ta ispB
default via <gatewayISP-B> dev eth0 proto static src <eth0ISP-B>
prohibit default proto static metric 1
[root@ICG surfNet]# ip route ls ta balance
default proto static
nexthop via <gatewayISP-A> dev eth3 weight 3
nexthop via <gatewayISP-B> dev eth0 weight 1
prohibit default proto static metric 1
[root@ICG surfNet]# ip route ls ta default
default via <gatewayISP-B> dev eth0
THE GOAL:
we want policy routing based on owner of the packet, in perticular we
want to handle squid to take the best path--best path according to
us(pls no BGP here).
WHAT WE TRIED:
we tried using iptables owner based rules & marked packets( as one can
see in rules above), but it didnt help.
iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 202.0.0.0/8
-j MARK --set-mark 50
iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 204.0.0.0/7
-j MARK --set-mark 50
iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 203.0.0.0/8
-j MARK --set-mark 75
iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 216.0.0.0/8
-j MARK --set-mark 75
but packets were not marked as seen by >> iptables -nvL -t mangle
& hence owner based pilicy routing not working
... hence now we turn to the list for help..
awaiting a reply ...
thanx to you all in advance...
A.H
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LARTC] owner based policy routing
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
@ 2002-10-11 21:30 ` Jose Luis Domingo Lopez
2002-10-11 21:57 ` Julian Anastasov
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Jose Luis Domingo Lopez @ 2002-10-11 21:30 UTC (permalink / raw
To: lartc
On Friday, 11 October 2002, at 09:34:38 +0530,
Arindam Haldar wrote:
> THE SCENARIO:
> we are connected to 2 isp, both having their large network.. isp A has
> gateway with ofc network while ispB has satellite gateway & hence there
> are advantages to take specific routes thru specific isp.
>
I suppose this box has three network connections, one to the internal
network, and one for each Internet connection. So, for the traffic
coming from the internal network, this box is a router.
> THE RULES DEFINED:
> 10: from all lookup main
>
"ip rule" are checked from lower to higher numbers, so once visited
"table local" (prio 0) all your traffic (from all) visits "table main".
I suppose "table main" doesn't have a default route of some sort,
because that would stop packet routing at that point, turning the rest
of "ip rule" useless.
> WHAT WE TRIED:
> we tried using iptables owner based rules & marked packets( as one can
> see in rules above), but it didnt help.
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 202.0.0.0/8
> -j MARK --set-mark 50
> but packets were not marked as seen by >> iptables -nvL -t mangle
> & hence owner based pilicy routing not working
>
If "iptable -t mangle -L -vn" shows no matches, it can be for two
reasons: either destination address doesn't match, or uid-owner doesn't
match. I have never used "--match owner" myself, but a quick try here
seems to work, at least for a simple network application.
Maybe squid runs as user "squid" (or whatever), but netfilter sees them
as originating from another user, maybe root, maybe no user at all.
--
Jose Luis Domingo Lopez
Linux Registered User #189436 Debian Linux Woody (Linux 2.4.18-586tsc)
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LARTC] owner based policy routing
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
2002-10-11 21:30 ` Jose Luis Domingo Lopez
@ 2002-10-11 21:57 ` Julian Anastasov
2002-10-14 12:33 ` Arindam Haldar
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Julian Anastasov @ 2002-10-11 21:57 UTC (permalink / raw
To: lartc
Hello,
On Fri, 11 Oct 2002, Arindam Haldar wrote:
> 50: from all fwmark 50 lookup ispA
fwmark in ip rule is 0x50 (it is defined and printed in hex)
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 202.0.0.0/8
> -j MARK --set-mark 50
and here 50 is 0x32 (not 0x50). Is that the problem?
Regards
--
Julian Anastasov <ja@ssi.bg>
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LARTC] owner based policy routing
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
2002-10-11 21:30 ` Jose Luis Domingo Lopez
2002-10-11 21:57 ` Julian Anastasov
@ 2002-10-14 12:33 ` Arindam Haldar
2002-10-14 14:26 ` Thilo Schulz
2002-10-14 21:34 ` Julian Anastasov
4 siblings, 0 replies; 6+ messages in thread
From: Arindam Haldar @ 2002-10-14 12:33 UTC (permalink / raw
To: lartc
ok, i have tried applying the ip rule fwmark in hex but dont see any
difference !..
The routing decission is take be4 the packets comes to OUTPUT table, if
thats true then it will be not possible to route **owner** as per policy
routing--am i right ??
if ys then how can one achieve **owner** based policy routing in linux
box ??
Julian Anastasov wrote:
> Hello,
>
> On Fri, 11 Oct 2002, Arindam Haldar wrote:
>
>
>>50: from all fwmark 50 lookup ispA
>
>
> fwmark in ip rule is 0x50 (it is defined and printed in hex)
>
>
>>iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 202.0.0.0/8
>> -j MARK --set-mark 50
>
>
> and here 50 is 0x32 (not 0x50). Is that the problem?
>
> Regards
>
> --
> Julian Anastasov <ja@ssi.bg>
>
>
>
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LARTC] owner based policy routing
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
` (2 preceding siblings ...)
2002-10-14 12:33 ` Arindam Haldar
@ 2002-10-14 14:26 ` Thilo Schulz
2002-10-14 21:34 ` Julian Anastasov
4 siblings, 0 replies; 6+ messages in thread
From: Thilo Schulz @ 2002-10-14 14:26 UTC (permalink / raw
To: lartc
Hello,
> WHAT WE TRIED:
> we tried using iptables owner based rules & marked packets( as one can
> see in rules above), but it didnt help.
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 202.0.0.0/8
> -j MARK --set-mark 50
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 204.0.0.0/7
> -j MARK --set-mark 50
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 203.0.0.0/8
> -j MARK --set-mark 75
> iptables -I OUTPUT -t mangle -m owner --uid-owner <squid> -d 216.0.0.0/8
> -j MARK --set-mark 75
Yes, I addressed once in the past this list with the very same problem. Owner
based policy routing seems not to be possible.
- Thilo Schulz
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LARTC] owner based policy routing
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
` (3 preceding siblings ...)
2002-10-14 14:26 ` Thilo Schulz
@ 2002-10-14 21:34 ` Julian Anastasov
4 siblings, 0 replies; 6+ messages in thread
From: Julian Anastasov @ 2002-10-14 21:34 UTC (permalink / raw
To: lartc
Hello,
On Mon, 14 Oct 2002, Arindam Haldar wrote:
> ok, i have tried applying the ip rule fwmark in hex but dont see any
> difference !..
It is already in hex, use something like:
ip rule ... fwmark 50
iptables ... --set-mark 0x50
> The routing decission is take be4 the packets comes to OUTPUT table, if
Right
> thats true then it will be not possible to route **owner** as per policy
> routing--am i right ??
The sockets select route and when localout selects different
ISP may be the source should be changed too.
> if ys then how can one achieve **owner** based policy routing in linux
> box ??
This is something that others should comment. NF is
supposed to do everything :)
Regards
--
Julian Anastasov <ja@ssi.bg>
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2002-10-14 21:34 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-10-11 4:16 [LARTC] owner based policy routing Arindam Haldar
2002-10-11 21:30 ` Jose Luis Domingo Lopez
2002-10-11 21:57 ` Julian Anastasov
2002-10-14 12:33 ` Arindam Haldar
2002-10-14 14:26 ` Thilo Schulz
2002-10-14 21:34 ` Julian Anastasov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.