bsilva

I'm working on an application where we use IPtables and IProute2 to setup a situation (similar to a firewall), where we have setup multiple routing tables and have some rules that direct traffic to different interfaces depending on the port number.

It generally works well, but I've come across a strange situation. The routing tables are sending a packet to interface #2, but the source IP address in the packet is that of interface #1. I suspect that the application is binding to interface #1 and that the source IP is being set before the routing rules get the packet.

Two questions:
1) Is this a likely explanation (why or why not).
2) How can I tell if this is the case (I don't have the source to the app).

I know the rules are working, because if I take out the IPtables line for the port I'm using, the traffic goes out the bond2 port. If I put the rule in, the packet goes out bond1. Either way the packet has a source IP of 192.168.102.190!

Any info/ideas appreciated,
Brad

Here's some config information:
------------------------
Output from "ip rule list":
0: from all lookup 255
2000: from all fwmark 0x1 lookup 1
32766: from all lookup main
32767: from all lookup default
------------------------
"iptables -L -n -t mangle":
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
MARK tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:21 MARK set 0x1
MARK udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:21 MARK set 0x1
MARK tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:22 MARK set 0x1
MARK udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:22 MARK set 0x1
MARK tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:23 MARK set 0x1
MARK udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:23 MARK set 0x1
MARK tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:162 MARK set 0x1
MARK udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:162 MARK set 0x1
-------------------------------
Output from "ip route show table 1":
192.168.102.0/24 dev bond2 scope link src 192.168.102.190
default via 192.168.102.6 dev bond2 src 192.168.102.190
------------------------------

Here's the weird thing. Here's a line from the output of "ip route show cache"
192.168.101.119 from 192.168.104.190 via 192.168.102.6 dev bond2
cache (null) 1500 ssthresh 1460 advmss 64

Note that the "from" address is not the same network as the "via" address.
-------------------------------