iptables trick for when you have an interface with a dynamic IP that is not your default gateway, but you want inbound port-forwarded traffic to still route properly. iptables -t mangle -D PREROUTING -m conntrack --ctstate DNAT -j MARK --set-mark 10 (+ usual route fwmark stuff)
-
-
Note: the routing table your fwmark gets pointed at needs to have the default route to the relevant interface (no need for static IPs if it's p2p like PPPoE, since that's interface only), and also your local subnet to its interface, else the 3rd packet onwards will hairpin.
Show this thread -
Update: though the above does work for general Linux routers, it disables hwnat acceleration on the EdgeRouter-X. This doesn't: iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -i pppoe0 -m state --state new -j CONNMARK --set-mark 10
Show this thread -
Incidentally, even though the Ralink hw_nat module is open source (the Cavium equivalent isn't...), I haven't been able to find where in the code it determines what firewall rules disable the fastpath. Still looking...
Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.