iptables trick for when you have an interface with a dynamic IP that is not your default gateway, but you want inbound port-forwarded traffic to still route properly. iptables -t mangle -D PREROUTING -m conntrack --ctstate DNAT -j MARK --set-mark 10 (+ usual route fwmark stuff)
-
Show this thread
-
This is easier to do via source IP policy-based routing if you have a static IP, but this way you don't need to hardcode the IP anywhere, for dynamic cases. If you have multiple such interfaces then maybe connmark stuff on the way in.
1 reply 0 retweets 4 likesShow this thread -
Note: the routing table your fwmark gets pointed at needs to have the default route to the relevant interface (no need for static IPs if it's p2p like PPPoE, since that's interface only), and also your local subnet to its interface, else the 3rd packet onwards will hairpin.
2 replies 0 retweets 3 likesShow this thread -
Update: though the above does work for general Linux routers, it disables hwnat acceleration on the EdgeRouter-X. This doesn't: iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -i pppoe0 -m state --state new -j CONNMARK --set-mark 10
1 reply 0 retweets 8 likesShow this thread
Incidentally, even though the Ralink hw_nat module is open source (the Cavium equivalent isn't...), I haven't been able to find where in the code it determines what firewall rules disable the fastpath. Still looking...
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.