Port-based routing

Linux 2.6.7
iptables 1.2.10
iproute2 latest & (predpolagaemo) greatest
Imam si nyakakyv default gw. Obache iskam vsichkiya trafik, deto e za port XX/tcp, da go prekaram prez gateway a.b.c.d. Bi tryabvalo (dokolkoto sym razbral) da stane taka:

iptables -t mangle -I PREROUTING -p tcp --dport XX -j MARK --set-mark 1
ip rule add priority 200 table 197 fwmark 1
ip route add via a.b.c.d table 197

Ama ne stava! Probvah i s vsichkite vyzmojni verigi v mangle tablicata - nyc! Mahnah si maskarada (SNAT) - nyc! Mahnah vsichko ot iptables - pak nyc!

Nyakoy da ima predstava sluchayno kak moje da stane?

Otkriyte greshkite: [линк]

Така... виж какво ти дава iptables -t mangle -nv
Като се изключи странния синтаксис на айпирут който си написал всичко би трябвало да работи. Давам ти една идея - пробвай с iptables -A PREROUTING а не -I PREROUTING. И една последна идея:
#ip route flush cache

Надеждата умира последна...
Но все пак умира

# iptables -t mangle -L -nv
Chain PREROUTING (policy ACCEPT 1631 packets, 771K bytes)
pkts bytes target prot opt in out source destination
253 18692 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:XX MARK set 0x1

Chain INPUT (policy ACCEPT 1342 packets, 736K bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 88 packets, 8111 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 1078 packets, 161K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 1170 packets, 170K bytes)
pkts bytes target prot opt in out source destination

# ip rule show
0: from all lookup local
200: from all fwmark 0x1 lookup 197
32766: from all lookup main
32767: from all lookup default

# ip route show table 197
default via a.b.c.d dev eth1
(dev e veren)

> #ip route flush cache
Da, i tova go pravya. Polza - net.

Otkriyte greshkite: [линк]

A napravi li ?
echo 1 > /proc/sys/net/ipv4/conf/eth*/rp_filter

ajde sys zdrave ...

Ne pomaga.
BTW, zabravil sym da kaja, che ip rule s drug kriteriy (ne fwmark) bachka.

Otkriyte greshkite: [линк]

Ето ти работеща конфигурация при мен ... Може и да ти помогне. Смятам че няма смисъл да казвам че изпозвам POM за iptables (версията е 1.2.9 )

echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

iptables -A PREROUTING -s "$INTERNAL_NET" -t mangle -p tcp -m mport --dport xxx -j MARK --set-mark 4
echo 202 cssh.in >> /etc/iproute2/rt_tables
ip rule add fwmark 4 table cssh.in

ip route add default via "$SEC_GW" dev "$SEC_INT" table cssh.in
ip route flush cache