iptables - MAC routing Post: 302893414

Sponsored Content

Special Forums IP Networking iptables - MAC routing Post 302893414 by wabbit02 on Wednesday 19th of March 2014 07:24:35 AM

03-19-2014

Registered User

I believe I have bound the solution using shorewall - and replicated it using iptabels.

the following config seems to yeld results - however I have not been able to find any good description for the use of nfmask and ctmask

Code:

iptables -t mangle -A POSTROUTING -m mark --mark 0x0/0xff -j CONNMARK --restore-mark --nfmask 0xff --ctmask 0xff
iptables -t mangle -A POSTROUTING -m mark ! --mark 0x0/0xff -j RETURN

iptables -t mangle -A PREROUTING -m mac --mac-source aa:aa:aa:aa:aa:aa -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -m mark ! --mark 0x0/0xff -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
iptables -t mangle -A PREROUTING -m mark ! --mark 0x0/0xff -j RETURN

ebtables -t nat -A OUTPUT -p IPv4 --ip-proto tcp --mark 2 -j dnat --to-dst aa:aa:aa:aa:aa:aa --dnat-target ACCEPT

Does anyone have a good description (or link to).

wabbit02

View Public Profile for wabbit02

Find all posts by wabbit02

4 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Routing or Iptables connections by hostname or ip address

edit; I found a solution that works, see thread #3 https://www.unix.com/302417065-post3.html Hi there, I have a small dedicated server that has four ip addresses and by default my httpd sends request using the servers main ip for all outbound connections. I'm quite amateur at routing and...

2. Cybersecurity

Configure iptables to allows list of MAC address

Hi all, I want to make this nw diagram: Small NW ---(eth1)-- Linux iptables --(eth0)---LAN NW And with these requirements: 1. Allow only 1 Mac address aa-aa-aa-aa-aa-aa from Small NW to LAN NW 2. Allow list of Mac addresses from LAN NW access to Small NW What will I...

3. IP Networking

iptables specific ip routing via tun

hi guys! I was searching few days for a solution to my problem but haven't found one or I'm too dumb to understand. Here's what happened: I have a linux server used as a router. It has an eth0 and eth1 (local interface). I just installed openvpn (I need it only as a client), I configured it and...

4. UNIX for Dummies Questions & Answers

iptables / ip route packet routing with multiple gateways

Hi all. Linux noob here. I was hoping someone could help me with configuring some routing rules on my router, an Asus AC68. The router is connected to two gateways, wan0_gateway and wan1_gateway. I have rules set up in the router gui that will push all traffic from every IP other than my own...

LEARN ABOUT FREEBSD

tc-fw

Firewall mark classifier in tc(8)				       Linux					 Firewall mark classifier in tc(8)

NAME

       fw - fwmark traffic control filter

SYNOPSIS

       tc filter ... fw [ classid CLASSID ] [ action ACTION_SPEC ]

DESCRIPTION

       the fw filter allows to classify packets based on a previously set fwmark by iptables.  If it is identical to the filter's handle, the fil-
       ter matches.  iptables allows to mark single packets with the MARK target, or whole connections using CONNMARK.	The benefit of using  this
       filter  instead of doing the heavy-lifting with tc itself is that on one hand it might be convenient to keep packet filtering and classifi-
       cation in one place, possibly having to match a packet just once, and on the other users familiar with iptables but not tc will have a less
       hard time adding QoS to their setups.

OPTIONS

       classid CLASSID
	      Push matching packets to the class identified by CLASSID.

       action ACTION_SPEC
	      Apply an action from the generic actions framework on matching packets.

EXAMPLES

       Take e.g. the following tc filter statement:

	      tc filter add ... handle 6 fw classid 1:1

       will match if the packet's fwmark value is 6.  This is a sample iptables statement marking packets coming in on eth0:

	      iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6

SEE ALSO

       tc(8), iptables(8), iptables-extensions(8)

iproute2							    21 Oct 2015 				 Firewall mark classifier in tc(8)