Доброго всем!
Помогите разобраться, пожалуйста. У самого уже мозгов и нервов не хватает (((
Сервер Школьный 7.0.3 Два интерфейса: enp3s1 - в модем, enp1s0 - в локалку. На нем три ip: 192.168.0.254, 192.168.1.254, 10.20.30.254
Сеть разделена на: 192.168.0.0/25 - компы учащихся,
192.168.0.129/25 - учителя,
192.168.1.0/24 - администрация,
10.20.30.0/24 - гости.
DHCP и Bind настроены и работают как часы, тут вопросов нет.
Настроил шейпер htb по различным статьям в сети. Вышло следующее:
[root@srv mangle]# service htb compile
/sbin/tc qdisc del dev enp3s1 root
/sbin/tc qdisc add dev enp3s1 root handle 1 htb default 9
/sbin/tc qdisc del dev enp1s0 root
/sbin/tc qdisc add dev enp1s0 root handle 1 htb default 9
find: warning: you have specified the -maxdepth option after a non-option argument (, but options are not positional (-maxdepth affects tests specified before it as well as those specified after it). Please specify options before other arguments.
find: warning: you have specified the -maxdepth option after a non-option argument (, but options are not positional (-maxdepth affects tests specified before it as well as those specified after it). Please specify options before other arguments.
/sbin/tc class add dev enp3s1 parent 1: classid 1:2 htb rate 100Mbit
/sbin/tc qdisc add dev enp3s1 parent 1:2 handle 2 sfq perturb 10
/sbin/tc class add dev enp3s1 parent 1:2 classid 1:4 htb rate 1024Kbit ceil 1024Kbit prio 5
/sbin/tc qdisc add dev enp3s1 parent 1:4 handle 4 sfq perturb 10
/sbin/tc class add dev enp3s1 parent 1:4 classid 1:5 htb rate 32Kbit ceil 432Kbit burst 10Kb prio 5
/sbin/tc qdisc add dev enp3s1 parent 1:5 handle 5 sfq perturb 10
/sbin/tc filter add dev enp3s1 parent 1:0 protocol ip prio 200 handle 101 fw classid 1:5
/sbin/tc class add dev enp3s1 parent 1:4 classid 1:6 htb rate 24Kbit ceil 128Kbit prio 5
/sbin/tc qdisc add dev enp3s1 parent 1:6 handle 6 sfq perturb 10
/sbin/tc filter add dev enp3s1 parent 1:0 protocol ip prio 200 handle 103 fw classid 1:6
/sbin/tc class add dev enp3s1 parent 1:4 classid 1:7 htb rate 32Kbit ceil 432Kbit burst 10Kb prio 5
/sbin/tc qdisc add dev enp3s1 parent 1:7 handle 7 sfq perturb 10
/sbin/tc filter add dev enp3s1 parent 1:0 protocol ip prio 200 handle 102 fw classid 1:7
/sbin/tc filter add dev enp3s1 parent 1:0 protocol ip prio 200 handle 104 fw classid 1:7
/sbin/tc class add dev enp3s1 parent 1:2 classid 1:9 htb rate 32Kbit ceil 32Kbit prio 6
/sbin/tc qdisc add dev enp3s1 parent 1:9 handle 9 sfq perturb 10
/sbin/tc class add dev enp1s0 parent 1: classid 1:2 htb rate 100Mbit
/sbin/tc qdisc add dev enp1s0 parent 1:2 handle 2 sfq perturb 10
/sbin/tc class add dev enp1s0 parent 1:2 classid 1:3 htb rate 70Mbit prio 3
/sbin/tc qdisc add dev enp1s0 parent 1:3 handle 3 sfq perturb 10
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 100 u32 match ip src 192.168.0.254/32 classid 1:3
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 100 u32 match ip src 192.168.1.254/32 classid 1:3
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 100 u32 match ip src 10.20.30.254/32 classid 1:3
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 100 u32 match ip src 192.168.10.2/32 classid 1:3
/sbin/tc class add dev enp1s0 parent 1:2 classid 1:4 htb rate 4Mbit ceil 4.5Mbit
/sbin/tc qdisc add dev enp1s0 parent 1:4 handle 4 sfq perturb 10
/sbin/tc class add dev enp1s0 parent 1:4 classid 1:5 htb rate 64Kbit ceil 2048Kbit burst 100Kb prio 5
/sbin/tc qdisc add dev enp1s0 parent 1:5 handle 5 sfq perturb 10
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 200 handle 101 fw classid 1:5
/sbin/tc class add dev enp1s0 parent 1:4 classid 1:6 htb rate 32Kbit ceil 512Kbit prio 6
/sbin/tc qdisc add dev enp1s0 parent 1:6 handle 6 sfq perturb 10
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 200 handle 103 fw classid 1:6
/sbin/tc class add dev enp1s0 parent 1:4 classid 1:7 htb rate 64Kbit ceil 2048Kbit burst 100Kb prio 4
/sbin/tc qdisc add dev enp1s0 parent 1:7 handle 7 sfq perturb 10
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 200 handle 102 fw classid 1:7
/sbin/tc filter add dev enp1s0 parent 1:0 protocol ip prio 200 handle 104 fw classid 1:7
/sbin/tc class add dev enp1s0 parent 1:2 classid 1:9 htb rate 32Kbit ceil 128Kbit prio 9
/sbin/tc qdisc add dev enp1s0 parent 1:9 handle 9 sfq perturb 10
[root@srv htb]# service htb list
### enp3s1: queueing disciplines
qdisc htb 1: root refcnt 2 r2q 10 default 9 direct_packets_stat 0
qdisc sfq 5: parent 1:5 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 6: parent 1:6 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 7: parent 1:7 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 9: parent 1:9 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
### enp3s1: traffic classes
class htb 1:9 parent 1:2 leaf 9: prio 6 rate 32000bit ceil 32000bit burst 1600b cburst 1600b
class htb 1:2 root rate 100000Kbit ceil 100000Kbit burst 1600b cburst 1600b
class htb 1:4 parent 1:2 rate 1024Kbit ceil 1024Kbit burst 1599b cburst 1599b
class htb 1:5 parent 1:4 leaf 5: prio 5 rate 32000bit ceil 432000bit burst 10Kb cburst 1599b
class htb 1:6 parent 1:4 leaf 6: prio 5 rate 24000bit ceil 128000bit burst 1599b cburst 1600b
class htb 1:7 parent 1:4 leaf 7: prio 5 rate 32000bit ceil 432000bit burst 10Kb cburst 1599b
### enp3s1: filtering rules
filter parent 1: protocol ip pref 200 fw
filter parent 1: protocol ip pref 200 fw handle 0x65 classid 1:5
filter parent 1: protocol ip pref 200 fw handle 0x66 classid 1:7
filter parent 1: protocol ip pref 200 fw handle 0x67 classid 1:6
filter parent 1: protocol ip pref 200 fw handle 0x68 classid 1:7
### enp1s0: queueing disciplines
qdisc htb 1: root refcnt 2 r2q 10 default 9 direct_packets_stat 5
qdisc sfq 3: parent 1:3 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 5: parent 1:5 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 6: parent 1:6 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 7: parent 1:7 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
qdisc sfq 9: parent 1:9 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
### enp1s0: traffic classes
class htb 1:2 root rate 100000Kbit ceil 100000Kbit burst 1600b cburst 1600b
class htb 1:3 parent 1:2 leaf 3: prio 3 rate 70000Kbit ceil 70000Kbit burst 1583b cburst 1583b
class htb 1:4 parent 1:2 rate 4000Kbit ceil 4500Kbit burst 1600b cburst 1599b
class htb 1:5 parent 1:4 leaf 5: prio 5 rate 64000bit ceil 2048Kbit burst 100Kb cburst 1599b
class htb 1:6 parent 1:4 leaf 6: prio 6 rate 32000bit ceil 512000bit burst 1600b cburst 1600b
class htb 1:7 parent 1:4 leaf 7: prio 4 rate 64000bit ceil 2048Kbit burst 100Kb cburst 1599b
class htb 1:9 parent 1:2 leaf 9: prio 7 rate 32000bit ceil 128000bit burst 1600b cburst 1600b
class sfq 9:2c parent 9:
### enp1s0: filtering rules
filter parent 1: protocol ip pref 100 u32
filter parent 1: protocol ip pref 100 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 100 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:3
match c0a800fe/ffffffff at 12
filter parent 1: protocol ip pref 100 u32 fh 800::801 order 2049 key ht 800 bkt 0 flowid 1:3
match c0a801fe/ffffffff at 12
filter parent 1: protocol ip pref 100 u32 fh 800::802 order 2050 key ht 800 bkt 0 flowid 1:3
match 0a141efe/ffffffff at 12
filter parent 1: protocol ip pref 100 u32 fh 800::803 order 2051 key ht 800 bkt 0 flowid 1:3
match c0a80a02/ffffffff at 12
filter parent 1: protocol ip pref 200 fw
filter parent 1: protocol ip pref 200 fw handle 0x65 classid 1:5
filter parent 1: protocol ip pref 200 fw handle 0x66 classid 1:7
filter parent 1: protocol ip pref 200 fw handle 0x67 classid 1:6
filter parent 1: protocol ip pref 200 fw handle 0x68 classid 1:7
Но при этом
[root@srv htb]# service htb stats
### enp3s1: queueing disciplines
qdisc htb 1: root refcnt 2 r2q 10 default 9 direct_packets_stat 0
Sent 9888494 bytes 86485 pkt (dropped 0, overlimits 2907 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 5: parent 1:5 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 1769241 bytes 19052 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 6: parent 1:6 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 3111762 bytes 21675 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 7: parent 1:7 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 4797070 bytes 43205 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 9: parent 1:9 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 210421 bytes 2553 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
### enp3s1: traffic classes
class htb 1:9 parent 1:2 leaf 9: prio 6 rate 32000bit ceil 32000bit burst 1600b cburst 1600b
Sent 210421 bytes 2553 pkt (dropped 0, overlimits 0 requeues 0)
rate 208bit 0pps backlog 0b 0p requeues 0
lended: 2553 borrowed: 0 giants: 0
tokens: 5890625 ctokens: 5890625
class htb 1:2 root rate 100000Kbit ceil 100000Kbit burst 1600b cburst 1600b
Sent 9888494 bytes 86485 pkt (dropped 0, overlimits 0 requeues 0)
rate 10784bit 13pps backlog 0b 0p requeues 0
lended: 0 borrowed: 0 giants: 0
tokens: 1932 ctokens: 1932
class htb 1:4 parent 1:2 rate 1024Kbit ceil 1024Kbit burst 1599b cburst 1599b
Sent 9678073 bytes 83932 pkt (dropped 0, overlimits 0 requeues 0)
rate 10576bit 13pps backlog 0b 0p requeues 0
lended: 4104 borrowed: 0 giants: 0
tokens: 188720 ctokens: 188720
class htb 1:5 parent 1:4 leaf 5: prio 5 rate 32000bit ceil 432000bit burst 10Kb cburst 1599b
Sent 1769241 bytes 19052 pkt (dropped 0, overlimits 0 requeues 0)
rate 4088bit 6pps backlog 0b 0p requeues 0
lended: 19049 borrowed: 0 giants: 0
tokens: 39789062 ctokens: 447328
class htb 1:6 parent 1:4 leaf 6: prio 5 rate 24000bit ceil 128000bit burst 1599b cburst 1600b
Sent 3111762 bytes 21675 pkt (dropped 0, overlimits 0 requeues 0)
rate 912bit 1pps backlog 0b 0p requeues 0
lended: 17550 borrowed: 4099 giants: 0
tokens: 8046869 ctokens: 1508789
class htb 1:7 parent 1:4 leaf 7: prio 5 rate 32000bit ceil 432000bit burst 10Kb cburst 1599b
Sent 4797070 bytes 43205 pkt (dropped 0, overlimits 0 requeues 0)
rate 5568bit 6pps backlog 0b 0p requeues 0
lended: 43197 borrowed: 5 giants: 0
tokens: 39789062 ctokens: 447328
### enp3s1: filtering rules
filter parent 1: protocol ip pref 200 fw
filter parent 1: protocol ip pref 200 fw handle 0x65 classid 1:5
filter parent 1: protocol ip pref 200 fw handle 0x66 classid 1:7
filter parent 1: protocol ip pref 200 fw handle 0x67 classid 1:6
filter parent 1: protocol ip pref 200 fw handle 0x68 classid 1:7
### enp1s0: queueing disciplines
qdisc htb 1: root refcnt 2 r2q 10 default 9 direct_packets_stat 5
Sent 103495370 bytes 109856 pkt (dropped 481, overlimits 219962 requeues 0)
backlog 0b 43p requeues 0
qdisc sfq 3: parent 1:3 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 4165528 bytes 14045 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 5: parent 1:5 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 5612 bytes 46 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 6: parent 1:6 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 7: parent 1:7 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 28710 bytes 265 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
qdisc sfq 9: parent 1:9 limit 127p quantum 1514b depth 127 divisor 1024 perturb 10sec
Sent 99288961 bytes 95495 pkt (dropped 2178, overlimits 0 requeues 0)
backlog 64758b 43p requeues 0
### enp1s0: traffic classes
class htb 1:2 root rate 100000Kbit ceil 100000Kbit burst 1600b cburst 1600b
Sent 103490641 bytes 109858 pkt (dropped 0, overlimits 0 requeues 0)
rate 132240bit 18pps backlog 0b 0p requeues 0
lended: 69263 borrowed: 0 giants: 0
tokens: 1827 ctokens: 1827
class htb 1:3 parent 1:2 leaf 3: prio 3 rate 70000Kbit ceil 70000Kbit burst 1583b cburst 1583b
Sent 4167358 bytes 14052 pkt (dropped 0, overlimits 0 requeues 0)
rate 3008bit 2pps backlog 0b 0p requeues 0
lended: 14052 borrowed: 0 giants: 0
tokens: 2596 ctokens: 2596
class htb 1:4 parent 1:2 rate 4000Kbit ceil 4500Kbit burst 1600b cburst 1599b
Sent 34322 bytes 311 pkt (dropped 0, overlimits 0 requeues 0)
rate 2152bit 2pps backlog 0b 0p requeues 0
lended: 0 borrowed: 0 giants: 0
tokens: 45437 ctokens: 40381
class htb 1:5 parent 1:4 leaf 5: prio 5 rate 64000bit ceil 2048Kbit burst 100Kb cburst 1599b
Sent 5612 bytes 46 pkt (dropped 0, overlimits 0 requeues 0)
rate 1160bit 1pps backlog 0b 0p requeues 0
lended: 46 borrowed: 0 giants: 0
tokens: 199714843 ctokens: 88744
class htb 1:6 parent 1:4 leaf 6: prio 6 rate 32000bit ceil 512000bit burst 1600b cburst 1600b
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0
lended: 0 borrowed: 0 giants: 0
tokens: 6250000 ctokens: 390625
class htb 1:7 parent 1:4 leaf 7: prio 4 rate 64000bit ceil 2048Kbit burst 100Kb cburst 1599b
Sent 28710 bytes 265 pkt (dropped 0, overlimits 0 requeues 0)
rate 1000bit 1pps backlog 0b 0p requeues 0
lended: 265 borrowed: 0 giants: 0
tokens: 199769531 ctokens: 90453
class htb 1:9 parent 1:2 leaf 9: prio 7 rate 32000bit ceil 128000bit burst 1600b cburst 1600b
Sent 99288961 bytes 95495 pkt (dropped 481, overlimits 0 requeues 0)
rate 127080bit 14pps backlog 0b 43p requeues 0
lended: 26232 borrowed: 69263 giants: 0
tokens: -4365197 ctokens: -1470666
class sfq 9:340 parent 9:
(dropped 0, overlimits 0 requeues 0)
backlog 64758b 43p requeues 0
allot -1176
### enp1s0: filtering rules
filter parent 1: protocol ip pref 100 u32
filter parent 1: protocol ip pref 100 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 100 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:3 (rule hit 107200 success 3807)
match c0a800fe/ffffffff at 12 (success 3807 )
filter parent 1: protocol ip pref 100 u32 fh 800::801 order 2049 key ht 800 bkt 0 flowid 1:3 (rule hit 103393 success 9573)
match c0a801fe/ffffffff at 12 (success 9573 )
filter parent 1: protocol ip pref 100 u32 fh 800::802 order 2050 key ht 800 bkt 0 flowid 1:3 (rule hit 93820 success 683)
match 0a141efe/ffffffff at 12 (success 683 )
filter parent 1: protocol ip pref 100 u32 fh 800::803 order 2051 key ht 800 bkt 0 flowid 1:3 (rule hit 93137 success 0)
match c0a80a02/ffffffff at 12 (success 0 )
filter parent 1: protocol ip pref 200 fw
filter parent 1: protocol ip pref 200 fw handle 0x65 classid 1:5
filter parent 1: protocol ip pref 200 fw handle 0x66 classid 1:7
filter parent 1: protocol ip pref 200 fw handle 0x67 classid 1:6
filter parent 1: protocol ip pref 200 fw handle 0x68 classid 1:7
Не могу понять, почему у меня весь трафик попадает в дефолтный (на самый ограниченный канал)?
Правила в iptables добавлены:
[root@srv htb]# service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
Table: mangle
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
MARK all -- 192.168.0.0/25 anywhere MARK set 0x65
RETURN all -- 192.168.0.0/25 anywhere
MARK all -- 192.168.0.128/25 anywhere MARK set 0x66
RETURN all -- 192.168.0.128/25 anywhere
MARK all -- 192.168.1.0/24 anywhere MARK set 0x68
RETURN all -- 192.168.1.0/24 anywhere
MARK all -- 10.20.30.0/24 anywhere MARK set 0x67
RETURN all -- 10.20.30.0/24 anywhere
MARK all -- anywhere 192.168.0.0/25 MARK set 0x65
RETURN all -- anywhere 192.168.0.0/25
MARK all -- anywhere 192.168.0.128/25 MARK set 0x66
RETURN all -- anywhere 192.168.0.128/25
MARK all -- anywhere 10.20.30.0/24 MARK set 0x67
RETURN all -- anywhere 10.20.30.0/24
MARK all -- anywhere 192.168.1.0/24 MARK set 0x68
RETURN all -- anywhere 192.168.1.0/24
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Table: filter
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -f anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ULOG all -- anywhere anywhere ULOG copy_range 48 nlgroup 1 prefix "icount" queue_threshold 50
ACCEPT tcp -- anywhere anywhere tcp dpt:webcache
ACCEPT udp -- anywhere anywhere udp dpt:openvpn
ACCEPT tcp -- anywhere anywhere tcp dpt:openvpn
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT udp -- anywhere anywhere udp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT udp -- anywhere anywhere udp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT udp -- anywhere anywhere udp dpt:https
ACCEPT icmp -- anywhere anywhere
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -f anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ULOG all -- anywhere anywhere ULOG copy_range 48 nlgroup 1 prefix "fcount" queue_threshold 50
ACCEPT all -- anywhere 192.168.10.0/30
ACCEPT all -- 192.168.1.0/24 192.168.0.0/24
ACCEPT all -- 28-0.zppl lex-s405.zppl
REJECT all -- 192.168.0.0/24 192.168.1.0/24 reject-with icmp-port-unreachable
ACCEPT all -- 10.20.30.0/24 192.168.10.0/30
REJECT all -- 10.20.30.0/24 192.168.1.0/24 reject-with icmp-port-unreachable
REJECT all -- 10.20.30.0/24 192.168.0.0/24 reject-with icmp-port-unreachable
ACCEPT all -- anywhere anywhere PHYSDEV match --physdev-is-bridged
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DROP all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DROP all -f anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ULOG all -- anywhere anywhere ULOG copy_range 48 nlgroup 1 prefix "ocount" queue_threshold 50
Ни каких других манипуляций с сетью не производил. Хотя вспомнил - иногда отваливается связь с сервером даже по локалке (видно как теряется подключение к Openfire). Но кратковременно. через пару сек все восстанавливается.
Может надо все таки не в mangle, а в nat записать правила PREROUTING?
Как проверить, маркируются ли пакеты? Пробовал смотреть tcpdump -i enp1s0 -vvv
Ничего в заголовках пакетов по поводу MARK не увидел (прошу громко не смеяться, если глупость сказал).
Куда копать?
Заранее благодарен.