# iproute2, CONFIG_IP_ROUTE_FWMARK not working correctly

## supermega

Hello.

I think that routing packets depending on the firewall mark ('ip rule add fwmark', CONFIG_IP_ROUTE_FWMARK) doesn't work correctly in Gentoo.

To show that I use a simple script (LAN + NAT + 2xISP):

```
#some info

PUB_GW_ISP1="1.1.1.4"

PUB_IP_ISP1="1.1.1.5"

DEV_ISP1="eth1"

PUB_GW_ISP2="2.2.2.4"

PUB_IP_ISP2="2.2.2.5"

DEV_ISP2="eth2"

LAN_NET="10.0.0.0/8"

TEST_IP="10.0.0.5"

#adding new routing table

echo "200 isp2" >> /etc/iproute2/rt_tables

# setting up routing tables

ip route add default via $PUB_GW_ISP1 dev $DEV_ISP1

ip route add default via $PUB_GW_ISP2 dev $DEV_ISP2 table isp2

# routing marked packets via table isp2

ip rule add fwmark 5 table isp2

# enable forwarding

echo "1" > /proc/sys/net/ipv4/ip_forward

# nat

iptables -t nat -A POSTROUTING -o $DEV_ISP1 -s $LAN_NET -j SNAT $PUB_IP_ISP1

iptables -t nat -A POSTROUTING -o $DEV_ISP2 -s $LAN_NET -j SNAT $PUB_IP_ISP2

# marking packets from $TEST_IP

iptables -t mangle -A PREROUTING -s $TEST_IP -j MARK --set-mark 5 
```

This should result in LAN connecting via ISP1 and TEST_IP via ISP2. But it doesn't, TEST_IP has no internet access.

When I traceroute some internet host from the TEST_IP I get replys only from my router and $PUB_GW_ISP2. Later there are only '*'.

Now something strange - if I wrote:

```
ip rule add from $TEST_IP table isp2
```

instead of all firewall marking it would work fine.

Solution?

I need to change default route to:

```
ip route add default nexthop via $PUB_GW_ISP1 dev $DEV_ISP1 nexthop via $PUB_GW_ISP2 dev $DEV_ISP2
```

Now packets from TEST_IP go via ISP2.

That's not what I actually wanted - I don't want multipath routing. To correct that I can add another routing table and send there all packets that would go to 'main'.

But I think the router shouldn't act so in 1st situation, should it?

Where's the problem?

Many people had the same problem (search the forum: 'fwmark'), but I didn't find the answer. I tested this script in Slackware and Aurox where it worked OK. In Debian on the other hand the problem is the same as in Gentoo.

kernel: 2.6.15-gentoo-r1

iptables v1.3.4 & iproute2-ss050310 from portage.

.super.

----------

## fratotec

Hello, 

I run in the same problem.... no solution for this problem ??

Franz

----------

## RAPHEAD

Hi,

I have a similar problem, I just want to use another GW for replies of HTTP requests to a server.

All other traffic should use the 'normal' default SW, so I tried this:

```

iptables -t mangle -I PREROUTING -i bond0 -p tcp -m multiport --dports 80,443 -j MARK --set-mark 2

ip rule add fwmark 2 table www.out

ip route add default via 192.168.200.1 dev bond0 table www.out

```

But it has no effect.

Even if I enable IP forwarding and do:

ip route flush cache

echo 0 > /proc/sys/net/ipv4/conf/bond0 /rp_filter

Any ideas?

----------

## tnt

same problem here.

 :Sad: 

----------

## RAPHEAD

Hi, I've found a solution, hope this helps

```

# Route traffic resulting from HTTP requests back through loadbalancer instead of default GW

# Mark all incoming connections on port 80

iptables -t mangle -A PREROUTING -i bond0 -m state --state NEW -p tcp --dport 80 -j CONNMARK --set-mark 2

# Restores the packet mark from the connection mark for packets generated on this machine

iptables -t mangle -A OUTPUT -o bond0 -j CONNMARK --restore-mark

# For all packets marked with mark '2' use the www.out routing table

ip rule add fwmark 2 lookup www.out

# Set the default route on the www.out routing table

ip route add default via 192.168.200.1 dev bond0 table www.out

```

www.out is the name of a custom table, see previous pos how to create it....

----------

