Re: About use_vmac :setting fwmark cause VRRP sent from base interface

--===============3457870399483222640==
Content-Type: multipart/alternative; boundary="0000000000002c05750576588183"

--0000000000002c05750576588183
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Quentin:
The command you gave works. Thank you so much!

So it seems that there is something else that affect the packets.
(Actually, no matter what bit(s) I set in fwmark, this problem occurs.)
Excluding VRRP packets from fwmark setting does solve my problem.

Thanks for your kindly reply,
Annie Weng

Quentin Armitage <[email protected]> =E6=96=BC 2018=E5=B9=B49=E6=9C=
=8820=E6=97=A5 =E9=80=B1=E5=9B=9B =E4=B8=8B=E5=8D=886:25=E5=AF=AB=E9=81=93=
=EF=BC=9A

> On Thu, 2018-09-20 at 17:50 +0800, =E7=BF=81=E6=B7=91=E5=AB=9A wrote:
>
> Hi all:
> I encounter a problem about fwmark and "use_vmac".
> I'm using keepalived 2.0.7 on OpenWrt 15.05 for some VRRPv3 tests, and I'=
d
> like the VRRP messages be sent via VMAC interface.
> Thus I set "use_vmac" and do not set "vmac_xmit_base".
> At the begining, with following config, VRRP via VMAC is OK.
> But after I set fwmark for other application by command:
>
> # iptables -t mangle -A OUTPUT -j MARK --set-xmark 0xff00/0xff00
>
> Just after the command, the VRRP become being sent from the base interfac=
e.
>
> Does anyone else encounter the same situation?
> Is it a normal behavoir of keepalived?
> And, is it possible to set fwmark for my other application and still keep
> VRRP via VMAC?
>
> Appreciate for any help.
> Thank you.
>
> Here is my config:
>
> global_defs {
>    router_id TEST1
>    vrrp_version 3
> }
>
> vrrp_instance VI_1 {
>    state MASTER
>    interface br-lan
>    virtual_router_id 1
>    priority 200
>    advert_int 1
>    use_vmac
>    virtual_ipaddress {
>       192.168.1.1
>    }
> }
>
> I have tried your configuration with keepalived v2.0.7 and I don't
> experience the same problem.
>
> Do you have some configuration elsewhere (e.g. routing) that causes
> packets matching the mark to be routed via br-lan? The man page for
> iptables-extensions(8) does state though that if you want to use the fwma=
rk
> for routing, the fwmark needs to be set in the PREROUTING chain, so setti=
ng
> it in the OUTPUT chain shouldn't be affecting routing.
>
> Would it work for you not to set the fwmark for VRRP packets? I think it
> is worth trying the following instead of the iptables command you gave, t=
o
> confirm that it is the fwmark causing the problem:.
> # iptables -t mangle -A OUTPUT ! -p 112 -j MARK --set-xmark 0xff00/0xff00
> which will mean that the fwmark is not set on vrrp adverts and check if
> the vrrp packets are then sent on the VMAC interface.
>
> If that doesn't fix it then an understanding of what the other applicatio=
n
> is doing with the marked packets, and working through the full
> iptables/nftables, ip rules and ip routes configurations would be necessa=
ry.
>
> I hope that helps,
>
> Quentin Armitage
>

--0000000000002c05750576588183
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Quentin:<br></div><div>The command you gave works.=
 Thank you so much!</div><div><br></div><div>
So it seems that there is something else that affect the packets. (Actually=
, no matter what bit(s) I set in fwmark, this problem occurs.) <br></div><d=
iv>Excluding VRRP packets from fwmark setting does solve my problem.<br></d=
iv><div><br></div><div>Thanks for your kindly reply,</div><div>Annie Weng<b=
r></div><div><br></div><div><div class=3D"gmail_quote"><div dir=3D"ltr">Que=
ntin Armitage &lt;<a href=3D"mailto:[email protected]">quentin@armita=
ge.org.uk</a>&gt; =E6=96=BC 2018=E5=B9=B49=E6=9C=8820=E6=97=A5 =E9=80=B1=E5=
=9B=9B =E4=B8=8B=E5=8D=886:25=E5=AF=AB=E9=81=93=EF=BC=9A<br></div><blockquo=
te class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc so=
lid;padding-left:1ex"><div bgcolor=3D"#ffffff" text=3D"#2e3436" link=3D"#2a=
76c6" vlink=3D"#2e3436"><div>On Thu, 2018-09-20 at 17:50 +0800, =E7=BF=81=
=E6=B7=91=E5=AB=9A wrote:</div><blockquote type=3D"cite" style=3D"margin:0 =
0 0 .8ex;border-left:2px #729fcf solid;padding-left:1ex"><div dir=3D"ltr"><=
div>Hi all:<br></div><div>I encounter a problem about fwmark and &quot;use_=
vmac&quot;.</div><div>I&#39;m using keepalived 2.0.7 on OpenWrt 15.05 for s=
ome VRRPv3 tests, and I&#39;d like the VRRP messages be sent via VMAC inter=
face.<br></div><div>Thus I set &quot;use_vmac&quot; and do not set &quot;vm=
ac_xmit_base&quot;.<br></div><div>At the begining, with following config, V=
RRP via VMAC is OK.</div><div>But after I set fwmark for other application =
by command: <br></div><div><br></div><div># iptables -t mangle -A OUTPUT -j=
 MARK --set-xmark 0xff00/0xff00<br></div><div><br></div><div>
<div>Just after the command, the VRRP become being sent from the base inter=
face.<br></div><div><br></div><div>Does anyone else encounter the same situ=
ation?<br></div>

</div><div>Is it a normal behavoir of keepalived?<br></div><div>And, is it =
possible to set fwmark for my other application and still keep VRRP via VMA=
C?</div><div><br></div><div>Appreciate for any help. <br></div><div>Thank y=
ou.<br></div><div><br></div><div>Here is my config:</div><div><br></div><di=
v>global_defs {</div><div>=C2=A0=C2=A0 router_id TEST1</div><div>=C2=A0=C2=
=A0 vrrp_version 3<br></div><div>}</div><div><br></div><div>vrrp_instance V=
I_1 {</div><div>=C2=A0=C2=A0 state MASTER</div><div>=C2=A0=C2=A0 interface =
br-lan</div><div>=C2=A0=C2=A0 virtual_router_id 1</div><div>=C2=A0=C2=A0 pr=
iority 200<br></div><div>=C2=A0=C2=A0 advert_int 1</div><div>=C2=A0=C2=A0 u=
se_vmac</div><div>=C2=A0=C2=A0 virtual_ipaddress {</div><div>=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 192.168.1.1<br></div><div>=C2=A0=C2=A0 }<br></div><div>}=
<br></div></div>
<pre></pre></blockquote><div>I have tried your configuration with keepalive=
d v2.0.7 and I don&#39;t experience the same problem.</div><div><br></div><=
div>Do you have some configuration elsewhere (e.g. routing) that causes pac=
kets matching the mark to be routed via br-lan? The man page for iptables-e=
xtensions(8) does state though that if you want to use the fwmark for routi=
ng, the fwmark needs to be set in the PREROUTING chain, so setting it in th=
e OUTPUT chain shouldn&#39;t be affecting routing.</div><div><br></div><div=
>Would it work for you not to set the fwmark for VRRP packets? I think it i=
s worth trying the following instead of the iptables command you gave, to c=
onfirm that it is the fwmark causing the problem:.</div><div># iptables -t =
mangle -A OUTPUT ! -p 112 -j MARK --set-xmark 0xff00/0xff00</div><div>which=
 will mean that the fwmark is not set on vrrp adverts and check if the vrrp=
 packets are then sent on the VMAC interface.</div><div><br></div><div>If t=
hat doesn&#39;t fix it then an understanding of what the other application =
is doing with the marked packets, and working through the full iptables/nft=
ables, ip rules and ip routes configurations would be necessary.</div><div>=
<br></div><div>I hope that helps,</div><div><br></div><div>Quentin Armitage=
</div></div></blockquote></div></div></div>

--0000000000002c05750576588183--


--===============3457870399483222640==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============3457870399483222640==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel

--===============3457870399483222640==--