Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Running Ubuntu 12.10 on amd64.

I'm trying to set up different routing rules for a particular user. I understand that the right way to do this is to create a firewall rule that marks the packets for that user, and add a routing rule for that mark. Just to get testing going, I've added a rule that discards all packets as unreachable:

# ip rule
0:  from all lookup local
32765:  from all fwmark 0x1 unreachable
32766:  from all lookup main
32767:  from all lookup default

With this rule in place and all firewall chains in all tables empty and policy ACCEPT, I can still ping remote hosts just fine as any user.

If I then add a rule to mark all packets and try to ping Google, it fails as expected

# iptables -t mangle -F OUTPUT
# iptables -t mangle -A OUTPUT -j MARK --set-mark 0x01
# ping www.google.com
ping: unknown host www.google.com

If I restrict this rule to the VPN user, it seems to have no effect.

# iptables -t mangle -F OUTPUT
# iptables -t mangle -A OUTPUT -j MARK --set-mark 0x01 -m owner --uid-owner vpn
# sudo -u vpn ping www.google.com
PING www.google.com (173.194.78.103) 56(84) bytes of data.
64 bytes from wg-in-f103.1e100.net (173.194.78.103): icmp_req=1 ttl=50 time=36.6 ms

But it appears that the mark is being set, because if I add a rule to drop these packets in the firewall, it works:

# iptables -t mangle -A OUTPUT -j DROP -m mark --mark 0x01
# sudo -u vpn ping www.google.com
ping: unknown host www.google.com

What am I missing? Thanks!

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Ping is setuid so that it has permission to construct ICMP packets - presumably this also prevents it from picking up the firewall mark. If I try this on a test box, and use dig or telnet in my test cases, the policy route looks to kick in properly.

share|improve this answer
    
Indeed, I observe the same thing. Still leaves a mystery as to why the DROP rule stops the ping from working, but means I can make progress on this issue. Thank you! –  Paul Crowley Nov 6 '12 at 7:37
    
I don't think it has stopped the ping - the error you get there is with the DNS lookup. Try pinging an IP in that test case instead of looking up a name. –  Jon Topper Nov 6 '12 at 15:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.