Help: Marking UDP packets in a bridge

Discussion:

Aravindhan Dhanasekaran

2014-10-10 15:28:00 UTC

Hello,

I'm trying to mark UDP packets entering (or leaving) a bridge, destined to a
particular UDP port on a machine on the other side of the bridge.

My simple topology looks like:
host1 [eth1] <-----> [s1-eth1] bridge [s1-eth2] <-----> [eth1] host2

I've added a rule to the FORWARD chain on the mangle table in the bridge to mark
the packets that I require:
$ sudo iptables -t mangle -A FORWARD -p udp --dport 9917 -j MARK --set-mark 17
$ iptables -L FORWARD -t mangle -v
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MARK udp -- any any anywhere anywhere udp
dpt:9917 MARK set 0x11

But, looks like none of packets are being marked (counters are all 0s in
iptables output as shown above). I have traffic matching the above rule flowing
through the bridge which I verified using tcpdump.
$ sudo tcpdump -i s1-eth1 udp dst port 9917
...
11:22:14.774417 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470
11:22:14.774597 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470
11:22:14.774731 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470^C

999 packets captured
1831 packets received by filter
795 packets dropped by kernel

I'm not sure what's wrong with my configuration. Any help would be appreciated.

Thanks,
/Aravind
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Vigneswaran R

2014-10-13 04:08:38 UTC

Permalink

Post by Aravindhan Dhanasekaran
Hello,
I'm trying to mark UDP packets entering (or leaving) a bridge, destined to a
particular UDP port on a machine on the other side of the bridge.
host1 [eth1] <-----> [s1-eth1] bridge [s1-eth2] <-----> [eth1] host2
I've added a rule to the FORWARD chain on the mangle table in the bridge to mark
$ sudo iptables -t mangle -A FORWARD -p udp --dport 9917 -j MARK --set-mark 17
$ iptables -L FORWARD -t mangle -v
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MARK udp -- any any anywhere anywhere udp
dpt:9917 MARK set 0x11
But, looks like none of packets are being marked (counters are all 0s in
iptables output as shown above). I have traffic matching the above rule flowing
through the bridge which I verified using tcpdump.
$ sudo tcpdump -i s1-eth1 udp dst port 9917
...
11:22:14.774417 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470
11:22:14.774597 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470
11:22:14.774731 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470^C

May be, we should do the packet marking using ebtables (instead of
iptables) for Ethernet bridge. I am not sure..

vignesh
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Aravindhan Dhanasekaran

2014-10-13 04:58:42 UTC

Permalink

Post by Vigneswaran R

May be, we should do the packet marking using ebtables (instead of
iptables) for Ethernet bridge. I am not sure..

When I added the above rule as a filter to my qdiscs, it worked as expected. So,
I guess my packets were actually marked, just that the counters were 0.

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Anton Danilov

2014-10-13 04:54:27 UTC

Permalink

Hello.

Check sysctl variable bridge-nf-call-iptables. It should be equals 1,
otherwise bridged traffic don't pass iptables.

--
Anton.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html