fwmark, policy routing, strict rp_filter drops legitimate inbound traffic
Issue
When setting up an environment with policy routing based on fwmarks, enabling strict rp_filter will break the flow of the traffic (rp_filter will drop inbound traffic though it seems it should not); setting rp_filter to 2 (loose/permissive filter) will restore normal operation, same if setting it to 0 (no filtering)
Note: strict rp_filter will not work (it will drop inbound traffic) when the incoming and the return path are not the same, this is by design, and if that is the case, strict rp_filter cannot be used, this article does not discuss that situation
Note: this is not a guide regarding how to configure such setup, this is intended for situations where everything is setup correctly, and the only problem remaining is rp_filter cannot be set to "strict" without breaking the traffic flow, hence a detailed discussion on the topic of policy routing is not suitable here
Environment
- Red Hat Enterprise Linux 6 (RHEL6) (any minor release)
- policy routing using multiple interfaces
- fwmark used for policy routing (fw marks employed for deciding which table to use)
- router setup (forwarding between 2 interfaces)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.