=== STEP_033B FWMARK RULES RUNTIME ONLY === timestamp=20260708-110408 intent: add runtime fwmark rules 0x203/0x204/0x205 only forbidden: nft marking, firewall changes, table 200 changes, production policy switch, network restart === BEFORE === date=Wed Jul 8 11:04:08 UTC 2026 === ip rule before === 0: from all lookup local 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 before === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 203-205 before === TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === production route get before === 1.1.1.1 from 10.200.0.10 dev vpn1 table 200 cache iif eth1 === marked route get before === MARK 0x203 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x203 uid 0 cache MARK 0x204 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x204 uid 0 cache MARK 0x205 1.1.1.1 via 95.165.96.1 dev eth0 src 95.165.105.4 mark 0x205 uid 0 cache === firewall vpn_out before === vpn_out_index=4 firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' === pings before === PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=53.722 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=53.483 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 53.483/53.602/53.722 ms PING_BEFORE_vpn1_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=52.121 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=52.335 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 52.121/52.228/52.335 ms PING_BEFORE_vpn3_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=50.172 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=50.094 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 50.094/50.133/50.172 ms PING_BEFORE_vpn4_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=61 time=58.918 ms 64 bytes from 1.1.1.1: seq=1 ttl=61 time=58.950 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 58.918/58.934/58.950 ms PING_BEFORE_vpn5_RC=0 === uci pending before === === ACTION: add runtime fwmark rules only === add_rule prio=10013 mark=0x203 table=203 rc=0 add_rule prio=10014 mark=0x204 table=204 rc=0 add_rule prio=10015 mark=0x205 table=205 rc=0 APPLY_FWMARK_RULES_RC=0 === ip rule after action === 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === AFTER / VERIFY === date=Wed Jul 8 11:04:13 UTC 2026 === ip rule after === 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 after === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === tables 203-205 after === TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === production route get after, unmarked === 1.1.1.1 from 10.200.0.10 dev vpn1 table 200 cache iif eth1 === marked route get after === MARK 0x203 1.1.1.1 dev vpn3 table 203 src 10.104.58.24 mark 0x203 uid 0 cache MARK 0x204 1.1.1.1 dev vpn4 table 204 src 10.103.120.171 mark 0x204 uid 0 cache MARK 0x205 1.1.1.1 dev vpn5 table 205 src 10.97.189.145 mark 0x205 uid 0 cache === marked + eth1 route get after === MARK_IIF_ETH1 0x203 1.1.1.1 from 10.200.0.10 dev vpn3 table 203 mark 0x203 cache iif eth1 MARK_IIF_ETH1 0x204 1.1.1.1 from 10.200.0.10 dev vpn4 table 204 mark 0x204 cache iif eth1 MARK_IIF_ETH1 0x205 1.1.1.1 from 10.200.0.10 dev vpn5 table 205 mark 0x205 cache iif eth1 === firewall vpn_out after === vpn_out_index=4 firewall.cfg0ddc81=zone firewall.cfg0ddc81.name='vpn_out' firewall.cfg0ddc81.input='REJECT' firewall.cfg0ddc81.output='ACCEPT' firewall.cfg0ddc81.forward='REJECT' firewall.cfg0ddc81.masq='1' firewall.cfg0ddc81.mtu_fix='1' firewall.cfg0ddc81.network='vpn1' 'vpn2' 'vpn_user' 'vpn3' 'vpn4' 'vpn5' === pings after === PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=54.292 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=53.648 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 53.648/53.970/54.292 ms PING_AFTER_vpn1_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=52.317 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=51.944 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 51.944/52.130/52.317 ms PING_AFTER_vpn3_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=50.074 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=50.488 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 50.074/50.281/50.488 ms PING_AFTER_vpn4_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=61 time=58.648 ms 64 bytes from 1.1.1.1: seq=1 ttl=61 time=58.838 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 58.648/58.743/58.838 ms PING_AFTER_vpn5_RC=0 === uci pending after === === rollback script === -rwx------ 1 root root 170 Jul 8 11:04 /root/router-ops-step033b-fwmark/rollback-fwmark-rules.sh === STEP_033B RESULT === apply_rc=0 rule203_lines=1 rule204_lines=1 rule205_lines=1 table200_default_vpn1_lines=1 table203_default_vpn3_lines=2 table204_default_vpn4_lines=2 table205_default_vpn5_lines=2 production_unmarked_vpn1_lines=1 mark203_vpn3=1 mark204_vpn4=1 mark205_vpn5=1 mark_iif203_vpn3=1 mark_iif204_vpn4=1 mark_iif205_vpn5=1 ping_vpn1_rc=0 ping_vpn3_rc=0 ping_vpn4_rc=0 ping_vpn5_rc=0 uci_pending_lines=0 decision=PASS_FWMARK_RULES_RUNTIME_ONLY