iptables trick for when you have an interface with a dynamic IP that is not your default gateway, but you want inbound port-forwarded traffic to still route properly. iptables -t mangle -D PREROUTING -m conntrack --ctstate DNAT -j MARK --set-mark 10 (+ usual route fwmark stuff)
-
-
Update: though the above does work for general Linux routers, it disables hwnat acceleration on the EdgeRouter-X. This doesn't: iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -i pppoe0 -m state --state new -j CONNMARK --set-mark 10
Show this thread -
Incidentally, even though the Ralink hw_nat module is open source (the Cavium equivalent isn't...), I haven't been able to find where in the code it determines what firewall rules disable the fastpath. Still looking...
Show this thread
End of conversation
New conversation -
-
-
Check out master device a.k.a. l3mdev as it helps with this and avoids the need to manually mark the packets. It reuses the same routing tables you’re using. Just with a lot more aotumagic to make things simpler.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.