Iptables's Connmark and mark.

Iptables's Connmark and mark.Posted on January 24, 2012

Iptables's Connmark and Mark are the two target for marking data connections and packets. Have not been clear about the difference between the two. Until yesterday spent a lot of time to solve the openwrt under the merger of ICBC Net bank login problem, to roughly understand the use of these two target.

The difference is that the same is the mark, but the Connmark is for the connection, and Mark is for a single packet.

So we must still not understand. But recall that both mechanisms are generally associated with Fwmark in IP rule to achieve a policy route to a packet that satisfies a certain class of conditions. So the crux of the matter is two points:

1. Mark the connection, just mark the connection, and do not mark each packet in the connection. Labeling a single packet does not affect the entire connection's markup. The two are relatively independent.

2. Routing Determination (routing decision) is based on a single packet. Or, beyond the netfilter framework, there is no concept of a connection tag. Or, IP commands only know mark, not what Connmark is.

So the key to writing related iptables rules is to tag all the single packets that are to be matched by IP rule. There are two methods: Use Mark to hit directly, or use Connmark–restore-mark to transfer the mark on the connection to the packet.

Understanding these, to solve the relevant problems in mind. For example, the issue of network Silver login, in the use of openwrt when you log in ICBC net silver, because the use of multiple IP, the server detected that there is a security problem, will prevent users from logging in. The solution is that, as the network silver with HTTPS protocol, the corresponding 443 port to do some processing. Let all outgoing packets with a destination port of 443 take only one line. In the iptables rule, it's just a mark on these packages. Suppose you play 0x01. The corresponding rules are written as follows:

# The first outgoing packet (TCP SYN), marked
iptables-t mangle-a prerouting-p tcp--dport 443-m NEW \ Conntrack
When Mark--set-mark 0x01
# Routing decision, the route that corresponds to the 0x01 tag is selected.
# Then, we dump the tag (0x01) on the packet to the corresponding connection. This is where the--save-mark function is.
iptables-t mangle-a postrouting-m conntrack--ctstate
new-j connmark--save-mark # The following packets are connected with the--restore-mark command, and the tag on the connection (saved by the previous command) is
then hit on each single packet.
iptables-t mangle-a prerouting-i br-lan-m conntrack--ctstate established,related \
-j CONNMARK--restore-ma RK
# At this point, all (outgoing packets with the destination port of 443) have a 0x01 tag for each packet on the connection, and the
# can be routed correctly.

This is entry is posted in Iptables and Linux by Morfast. The Bookmark the permalink. 2 Thoughts on "Iptables's Connmark and Mark"