Bug 9812
Summary: | Kernel does not deliver packets going through the INPUT chain even if the app is listening on IN_ADDR_ANY | ||
---|---|---|---|
Product: | Networking | Reporter: | Pawel Rogocz (pawel) |
Component: | Netfilter/Iptables | Assignee: | networking_netfilter-iptables (networking_netfilter-iptables) |
Status: | REJECTED INVALID | ||
Severity: | normal | CC: | protasnb |
Priority: | P1 | ||
Hardware: | All | ||
OS: | Linux | ||
Kernel Version: | 2.6.22-14 | Subsystem: | |
Regression: | --- | Bisected commit-id: |
Description
Pawel Rogocz
2008-01-25 03:59:27 UTC
That doesn't work, you're routing the packet locally, but the destination address is non-local. Try REDIRECT or DNAT. This is not a bug, please close and turn to netfilter@vger.kernel.org. Reply-To: akpm@linux-foundation.org > On Fri, 25 Jan 2008 03:59:27 -0800 (PST) bugme-daemon@bugzilla.kernel.org > wrote: > http://bugzilla.kernel.org/show_bug.cgi?id=9812 > > Summary: Kernel does not deliver packets going through the INPUT > chain even if the app is listening on IN_ADDR_ANY > Product: Networking > Version: 2.5 > KernelVersion: 2.6.22-14 > Platform: All > OS/Version: Linux > Tree: Mainline > Status: NEW > Severity: normal > Priority: P1 > Component: Netfilter/Iptables > AssignedTo: networking_netfilter-iptables@kernel-bugs.osdl.org > ReportedBy: pawel@rogocz.com > > > Latest working kernel version: never worked > Earliest failing kernel version: > Distribution: ubuntu 7.10 > > Problem Description: > > I have a farm of web servers behind a load balancer in DSR mode. > I would like to be able to dump packets with any IP address on the web > servers > through the load balancer and have web servers reply to these requests. > Currently for every IP web servers are supposed to reply to, I have to > configure the IP on all servers on their loopback interfaces. The web server > listens on IN_ADDR_ANY and I am forcing packets into the INPUT chain via > iptables/netfilter but the kernel never replies to any connection requests. I > only see the counter for OutNoRoutes increasing. > > Steps to reproduce: > > web server: > > #iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK > --set-mark > 1 > #ip route add to local default dev lo protocol kernel table 1 > #ip rule add fwmark 1 table 1 priority 1 > > client: > > #ip route add 1.1.1.1/32 via <web server IP> dev eth0 > > while making requests to 1.1.1.1:80 from the client you can see increasing > OutNoRoutes counter but no connection ever takes place. > > Andrew Morton wrote: >> On Fri, 25 Jan 2008 03:59:27 -0800 (PST) bugme-daemon@bugzilla.kernel.org >> wrote: >> http://bugzilla.kernel.org/show_bug.cgi?id=9812 >> >> Problem Description: >> >> I have a farm of web servers behind a load balancer in DSR mode. >> I would like to be able to dump packets with any IP address on the web >> servers >> through the load balancer and have web servers reply to these requests. >> Currently for every IP web servers are supposed to reply to, I have to >> configure the IP on all servers on their loopback interfaces. The web server >> listens on IN_ADDR_ANY and I am forcing packets into the INPUT chain via >> iptables/netfilter but the kernel never replies to any connection requests. >> I >> only see the counter for OutNoRoutes increasing. >> >> Steps to reproduce: >> >> web server: >> >> #iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK >> --set-mark >> 1 >> #ip route add to local default dev lo protocol kernel table 1 >> #ip rule add fwmark 1 table 1 priority 1 >> >> client: >> >> #ip route add 1.1.1.1/32 via <web server IP> dev eth0 >> >> while making requests to 1.1.1.1:80 from the client you can see increasing >> OutNoRoutes counter but no connection ever takes place. I already commented in bugzilla, this is not a bug but an incorrect setup. DNAT or REDIRECT must be used to make this work properly. Closing the bug as noted. (Partick, I am not sure what you meant in #1. I can't reassign it to netfilter@vger.kernel.org, this account doesn't exist in bugzilla. Does it need to be created?) No, that is the netfilter user mailing list :) I meant to say that this is a misunderstanding of how this works and the userlist is an appropriate forum to ask for help. Ok, that was first thing that I thought... :) |