Hello folks, since reading wiki and searching a bit about it I couldn’t solve that “problem”, I’ll ask the community in hope someone shed some light on it.
I have a mangle with about a hundred rules. I have a PPPoE client running, for internet access along with other 2 links with fixed IP. Each WAN in an different port. ether6 and ether8 has fixed IP and pppoe connection runs on ether4.
In the very beggining of the mangle, I have 3 rules, on prerouting chain with in-interface set to those WAN ports, that jumps to a custom chain, like this:
chain=prerouting action=jump jump-target=z-balance-inwan in-interface=ether6 connection-mark=no-mark
chain=prerouting action=jump jump-target=z-balance-inwan in-interface=ether8 connection-mark=no-mark
chain=prerouting action=jump jump-target=z-balance-inwan in-interface=pppoe-wan connection-mark=no-mark
After this rules I have some other that works with local traffic, all on prerouting chain, and a rule like this:
chain=prerouting action=mark-connection new-connection-mark=Conn-Impossible passthrough=yes connection-mark=no-mark
And after that some rules that works in the custom chain “z-ballance-inwan”. And among rules in that custom chain, in the bottom of it I have a rule that mark all connections that have not yet been mark so it will be droped on filter, like this:
chain=z-balance-inwan action=mark-connection new-connection-mark=Conn-Block passthrough=yes connection-mark=no-mark
The funny thing is, that rule that marks connection as “Conn-Impossible” are receiving packets comming from PPPoE client interface. It should be impossible I think, becase traffic comming from Internet, should be captured by the rule that send the packed to the custom chain, if it have no mark. And it will have no mark ONLY if it is a new connection, because after it pass through the “z-ballance-inwan” chain, it will absolutely have a mark,
Is there anything I am missing?
Another thing that is bothering me is that rule is also capturing lots of packets from the internal network. All the packets from internal network are also sent to a custom chain and they will get a connection mark, so they don’t need to get through all the rules again in the future. The local network are connected to the routerboard by pppoe, and this rule is capturing TCP ACK packets, FROM CLIENT INTERFACE with source addresses from INTERNET, and destination address to an address from that client internal network. By my understading, ACK packets should be sent FROM the client to the server. Also, strange enough is that those packets are getting here without a mark, because if the client request a connection, it will be sent to a custom chain that WILL mark that connection.
I know it is kind a long post, if anyone have an idea, it would be appreciated.
.