Starbloom
Occasional Visitor
Hi Everyone,
I am trying to create my own iptables rules that mark connection from 1-0xff. But I couldn't seem to mark any packet to anything above 6. Why is that? It seems asuswrt is changing the packet marking somehow. Please see my questions in comments below.
Another problem is that I couldn't seem to use iptables classify target. As soon as I use it, the router crashes and reboots. Good I am testing using ssh so it comes back ok without those rules.
Thanks.
I am trying to create my own iptables rules that mark connection from 1-0xff. But I couldn't seem to mark any packet to anything above 6. Why is that? It seems asuswrt is changing the packet marking somehow. Please see my questions in comments below.
Another problem is that I couldn't seem to use iptables classify target. As soon as I use it, the router crashes and reboots. Good I am testing using ssh so it comes back ok without those rules.
Thanks.
Code:
#!/bin/sh
# Setup mangle table
DEV=$(nvram get wan0_gw_ifname)
# remove default rule with mask 0x7 and replace it with our own mask 0xff
iptables -t mangle -D PREROUTING -i ${DEV} -j CONNMARK --restore-mark --nfmask 0x7 --ctmask 0x7
iptables -t mangle -D PREROUTING -i ${DEV} -j CONNMARK --restore-mark --nfmask 0xff --ctmask 0xff
iptables -t mangle -I PREROUTING -i ${DEV} -j CONNMARK --restore-mark --nfmask 0xff --ctmask 0xff
# reinitialize QOSO chain
iptables -t mangle -N QOSO
iptables -t mangle -F QOSO
iptables -t mangle -D FORWARD -o ${DEV} -j QOSO
iptables -t mangle -D OUTPUT -o ${DEV} -j QOSO
iptables -t mangle -D POSTROUTING -o br0 -j QOSO
iptables -t mangle -A FORWARD -o ${DEV} -j QOSO
iptables -t mangle -A OUTPUT -o ${DEV} -j QOSO
iptables -t mangle -A POSTROUTING -o br0 -j QOSO
iptables -t mangle -A QOSO -m mark --mark 0xb400 -j RETURN
iptables -t mangle -A QOSO -j CONNMARK --restore-mark --nfmask 0xff --ctmask 0xff
### Question, why is this rule here? No packets are supposed to be marked within mask 0xff00.
### It does seem some packet will fall into this. but where are they coming from?
### Should it do a return for any packets that have been marked?
iptables -t mangle -A QOSO -m connmark ! --mark 0x0/0xff00 -j RETURN
# DNS, Time, etc
iptables -t mangle -A QOSO -p tcp -m multiport --dports 53,37,123,3455 -m connbytes --connbytes 0:10239 --connbytes-mode bytes --connbytes-dir both -j CONNMARK --set-mark 0x2/0xff
iptables -t mangle -A QOSO -p tcp -m multiport --dports 53,37,123,3455 -m connbytes --connbytes 0:10239 --connbytes-mode bytes --connbytes-dir both -j RETURN
iptables -t mangle -A QOSO -p udp -m multiport --dports 53,37,123,3455 -m connbytes --connbytes 0:10239 --connbytes-mode bytes --connbytes-dir both -j CONNMARK --set-mark 0x2/0xff
iptables -t mangle -A QOSO -p udp -m multiport --dports 53,37,123,3455 -m connbytes --connbytes 0:10239 --connbytes-mode bytes --connbytes-dir both -j RETURN
### Question & Problem: It seems I can mark the new connection to 0x7, but only that initial
### packet got classified into the proper tc class. All the packets after that seems to be classified
### as the default which is 0x4. Why?
# Limit speed for P2P
iptables -t mangle -A QOSO -p udp -m mac --mac-source <mac_address> -j CONNMARK --set-mark 0x7/0xff
iptables -t mangle -A QOSO -p udp -m mac --mac-source <mac_address> -j RETURN
iptables -t mangle -A QOSO -p tcp -m mac --mac-source <mac_address> -j CONNMARK --set-mark 0x7/0xff
iptables -t mangle -A QOSO -p tcp -m mac --mac-source <mac_address> -j RETURN
# Torrents from server, lowest priority
#iptables -t mangle -I QOSO 4 -p tcp -m mac --mac-source <mac_address> -m multiport --sports 51701:52397,63707 -j RETURN
#iptables -t mangle -I QOSO 4 -p tcp -m mac --mac-source <mac_address> -m multiport --sports 51701:52397,63707 -j CONNMARK --set-mark 0x5/0xff
#iptables -t mangle -I QOSO 4 -p udp -m mac --mac-source <mac_address> -m multiport --sports 51701:52397,63707 -j RETURN
#iptables -t mangle -I QOSO 4 -p udp -m mac --mac-source <mac_address> -m multiport --sports 51701:52397,63707 -j CONNMARK --set-mark 0x5/0xff
iptables -t mangle -A QOSO -d 224.0.0.0/4 -j CONNMARK --set-mark 0x6/0xff
iptables -t mangle -A QOSO -d 224.0.0.0/4 -j RETURN
iptables -t mangle -A QOSO -d 192.168.1.0/24 -j CONNMARK --set-mark 0x6/0xff
iptables -t mangle -A QOSO -d 192.168.1.0/24 -j RETURN
iptables -t mangle -A QOSO -j CONNMARK --set-mark 0x4/0xff
iptables -t mangle -A QOSO -j RETURN
