OpenWrt Forum Archive

Topic: iptables --set-mark not working....

The content of this topic has been archived between 12 Apr 2018 and 19 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

root@OpenWrt:~# ls -l /lib/modules/`uname -r`
-rw-r--r--    1 root     root       327456 Sep 30 18:38 ath_hal.ko
-rw-r--r--    1 root     root       131648 Sep 30 18:38 ath_pci.ko
-rw-r--r--    1 root     root        15528 Sep 30 18:38 ath_rate_minstrel.ko
-rw-r--r--    1 root     root         2572 Sep 29 07:39 crc-ccitt.ko
-rw-r--r--    1 root     root        39608 Sep 29 07:38 diag.ko
-rw-r--r--    1 root     root         3944 Sep 29 07:38 ipt_ECN.ko
-rw-r--r--    1 root     root        10412 Sep 29 07:38 ipt_LOG.ko
-rw-r--r--    1 root     root         3068 Sep 29 07:38 ipt_TOS.ko
-rw-r--r--    1 root     root         3164 Sep 29 07:38 ipt_TTL.ko
-rw-r--r--    1 root     root         3240 Sep 29 07:38 ipt_ecn.ko
-rw-r--r--    1 root     root        13148 Sep 29 07:38 ipt_ipp2p.ko
-rw-r--r--    1 root     root        19112 Sep 29 07:38 ipt_layer7.ko
-rw-r--r--    1 root     root         2888 Sep 29 07:38 ipt_owner.ko
-rw-r--r--    1 root     root         4152 Sep 29 07:38 ipt_time.ko
-rw-r--r--    1 root     root         2328 Sep 29 07:38 ipt_tos.ko
-rw-r--r--    1 root     root         2816 Sep 29 07:38 ipt_ttl.ko
-rw-r--r--    1 root     root         3872 Sep 29 07:38 iptable_raw.ko
-rw-r--r--    1 root     root        16856 Sep 29 07:39 ppp_async.ko
-rw-r--r--    1 root     root        34948 Sep 29 07:39 ppp_generic.ko
-rw-r--r--    1 root     root        18456 Sep 29 07:39 pppoe.ko
-rw-r--r--    1 root     root         4448 Sep 29 07:39 pppox.ko
-rw-r--r--    1 root     root         8504 Sep 29 07:39 slhc.ko
-rw-r--r--    1 root     root        15076 Sep 29 07:40 switch-adm.ko
-rw-r--r--    1 root     root        10272 Sep 29 07:40 switch-core.ko
-rw-r--r--    1 root     root         9996 Sep 29 07:40 switch-robo.ko
-rw-r--r--    1 root     root        13532 Sep 29 07:39 tun.ko
-rw-r--r--    1 root     root       220076 Sep 30 18:38 wlan.ko
-rw-r--r--    1 root     root         5252 Sep 30 18:38 wlan_acl.ko
-rw-r--r--    1 root     root         9672 Sep 30 18:38 wlan_ccmp.ko
-rw-r--r--    1 root     root         6388 Sep 30 18:38 wlan_scan_ap.ko
-rw-r--r--    1 root     root        15064 Sep 30 18:38 wlan_scan_sta.ko
-rw-r--r--    1 root     root        14116 Sep 30 18:38 wlan_tkip.ko
-rw-r--r--    1 root     root         7476 Sep 30 18:38 wlan_wep.ko
-rw-r--r--    1 root     root         2532 Sep 30 18:38 wlan_xauth.ko
-rw-r--r--    1 root     root         6388 Sep 29 07:38 xt_CHAOS.ko
-rw-r--r--    1 root     root         2656 Sep 29 07:38 xt_CLASSIFY.ko
-rw-r--r--    1 root     root         5628 Sep 29 07:38 xt_DELUDE.ko
-rw-r--r--    1 root     root         3452 Sep 29 07:38 xt_DSCP.ko
-rw-r--r--    1 root     root         3320 Sep 29 07:38 xt_MARK.ko
-rw-r--r--    1 root     root         3080 Sep 29 07:38 xt_dscp.ko
-rw-r--r--    1 root     root         2764 Sep 29 07:38 xt_length.ko
-rw-r--r--    1 root     root         2724 Sep 29 07:38 xt_mac.ko
-rw-r--r--    1 root     root         2684 Sep 29 07:38 xt_mark.ko
-rw-r--r--    1 root     root         2752 Sep 29 07:38 xt_pkttype.ko
-rw-r--r--    1 root     root         8084 Sep 29 07:38 xt_portscan.ko
-rw-r--r--    1 root     root         3244 Sep 29 07:38 xt_string.ko



xt_mark is not responsible ??

where do i get the missing ipt_mark ?

anyone ?

you need both the userspace and the kernel space module

userspace: libipt_MARK.so  (iptables command line module)
kernelspace: xt_MARK.ko   (kernel module that play with packets)

on a normal linux box, you need to recompile iptables and your kernel to add those modules. On Kamakaze I don't know if there is another way.

you could join irc.freenode.org #openwrt (irc server) to talk live with people

problem is , this is a fresh !! 7.09 installation

root@OpenWrt:/usr/lib/iptables# ls
libipt_CHAOS.so       libipt_TCPMSS.so      libipt_pkttype.so
libipt_DELUDE.so      libipt_conntrack.so   libipt_portscan.so
libipt_DNAT.so        libipt_icmp.so        libipt_standard.so
libipt_LOG.so         libipt_ipp2p.so       libipt_state.so
libipt_MASQUERADE.so  libipt_layer7.so      libipt_string.so
libipt_REDIRECT.so    libipt_limit.so       libipt_tcp.so
libipt_REJECT.so      libipt_multiport.so   libipt_tcpmss.so
libipt_SNAT.so        libipt_owner.so       libipt_udp.so


im lacking libipt_MARK

SirDodger wrote:

problem is , this is a fresh !! 7.09 installation

Correct - what you want is the "iptables-mod-ipopt" package.  Here's what I've got on my Netgear WGT634U:

# uname -a
Linux otros 2.6.22 #2 Sun Sep 30 20:38:47 CEST 2007 mips unknown
# ipkg files iptables-mod-ipopt
Package iptables-mod-ipopt (1.3.7-1) is installed on root and has the following
files:
/usr/lib/iptables/libipt_mark.so
/usr/lib/iptables/libipt_CLASSIFY.so
/usr/lib/iptables/libipt_TOS.so
/usr/lib/iptables/libipt_ECN.so
/usr/lib/iptables/libipt_MARK.so   *****
/usr/lib/iptables/libipt_DSCP.so
/usr/lib/iptables/libipt_dscp.so
/usr/lib/iptables/libipt_ttl.so
/usr/lib/iptables/libipt_mac.so
/usr/lib/iptables/libipt_TTL.so
/usr/lib/iptables/libipt_tos.so
/usr/lib/iptables
/usr/lib/iptables/libipt_length.so
/usr/lib/iptables/libipt_ecn.so

Done.

For anyone else who had this problem - I installed iptables-mod-conntrack-extra and now it works.

rorus wrote:

For anyone else who had this problem - I installed iptables-mod-conntrack-extra and now it works.

Errr, no... what you want is what the poster above said: iptables-mod-ipopt

iptables -A OUTPUT -p tcp -m multiport --dports 25 -j MARK --set-mark 0x1
iptables v1.4.6: unknown option `--set-mark'
Try `iptables -h' or 'iptables --help' for more information.

root@OpenWrt:/etc/iproute2# opkg install iptables-mod-ipopt

Installing iptables-mod-ipopt (1.4.6-2) to root...
Downloading http://downloads.openwrt.org/backfire/10.03/ar71xx/packages/iptables-mod-ipopt_1.4.6-2_ar71xx.ipk.
Installing kmod-ipt-ipopt (2.6.32.10-1) to root...
Downloading http://downloads.openwrt.org/backfire/10.03/ar71xx/packages/kmod-ipt-ipopt_2.6.32.10-1_ar71xx.ipk.
Configuring kmod-ipt-ipopt.
Configuring iptables-mod-ipopt.

root@OpenWrt:/etc/iproute2# !ip
iptables -A OUTPUT -p tcp -m multiport --dports 25 -j MARK --set-mark 0x1
root@OpenWrt:/etc/iproute2#

Thx.

The discussion might have continued from here.