Thanks for Reply Krisztian after i insert this rules: ip rule add dev eth0 fwmark 1 lookup 100 ip rule add dev eth1 fwmark 1 lookup 100 ip rule add dev br0 fwmark 1 lookup 100 i must to insert this route: ip route add local 0.0.0.0/0 dev lo table 100 or dont? 2010/1/8 KOVACS Krisztian <hidden@balabit.hu>:
Hi,
On 01/07/2010 11:56 AM, Luiz Biazus wrote:
let me explain what is funny i have this plataform:
ubuntu 9.04 kernel 2.6.32 iptables 1.4.6 squid 3.1 running in port 8012
[...]
until here all is OK even i can UP all this rulles that i discribe before and every thing seems to be OK!
BUT!
if i up THIS RULES:
ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100
I LOST COMMUNICATION WITH MY PROXY
I'm afraid this was caused by Jamal's rp_filter change committed in Linux 2.6.32.
You can find more information on the issue in the linux-netdev or tproxy mailing list archives:
http://marc.info/?l=linux-netdev&m=125925598910379&w=2
This is expected to be fixed in an upcoming -stable release (2.6.32.z), in the meantime you can use the workaround mentioned in that mail thread: instead of the 'ip rule add fwmark 1 lookup 100' rule, you have to use one rule per interface.
<quote> The workaround is using more specific ip rules that include the ingress interface name:
# ip rule add dev eth0 fwmark 1 lookup 100
(repeat the above for each interface except lo.) </quote>
Hope this helps.
Cheers, Krisztian