I have a router with two internet connections, ISP1 and ISP2.
There is a default route towards ISP1 in the main table, and additionally there are separate route tables for ISP1 and ISP2 with each a default route.
There are mangle rules for prerouting and output which match on the statically assigned internet addresses for ISP1 and ISP2 and apply a routing mark that sends the traffic to the proper route table.
That all works fine for almost all traffic, except that I have GRE tunnels with IPsec encryption, and the ISAKMP traffic is not marked appropriately.
Apparently it is neither considered for prerouting nor for output chain, but these are the only two chains that allow mark-routing action.
As the source address of the GRE tunnel is set to the ISP2 address, the traffic should have been marked with the ISP2 mark but it isn’t, and the tunnel establishment fails because ISP1 applies source address filtering.
Is there any workaround to mark the ISAKMP traffic? Or should this be considered a bug?
(I only notice this now because the remote is down at the moment. when the remote makes the connection the usual route marking for incoming traffic in a pre-routing connection mark works OK)