Re: [BUG / question] in routing rules, some options (e.g. ipproto, sport) cause rules to be ignored in presence of packet marks

On 3/28/21 4:05 PM, Michal Soltys wrote:

Hi,

iptables -t mangle -A OUTPUT -j MARK --set-mark 1

After some extra checks, the exact same issue happens if we mangle tos 
instead of mark, so ...

iptables -t mangle -A OUTPUT -j TOS --set-tos 0x02

... will cause same routing issues with incorrect output interface being 
set.

Anyway, I've attached 2 scripts setting up namespace with all those cases.

- run setup-host.sh
- then in the namespace: run setup-namespace.sh
- fire up another bash in ns with tcpdump on right1

nc -u -p 1194 1.2.3.4 12345

This will work fine, as the packet will be routed correctly via right2, 
tcpdump will show nothing

Now add in the namespace:

iptables -t mangle -A OUTPUT -j MARK --set-mark 1

or

iptables -t mangle -A OUTPUT -j TOS --set-tos 0x02

Same nc as above - now the packet will go out via right1, using right2's 
address (initial routing decision).


Unrelated issue - while doing the tests I noticed that routing rules 
based on tos have no effect at all for locally generated packets. Will 
make another post about it though.