I just realised that all the iptables rules I have been applying to myopen Vswitch interfaces never match.I am using iptables to mark some packets, and then I use TC (trafficcontrol) filters to put packets into different priority queuesdepending on the Iptables match. That works for every interface, andeven for Linux Bridges (using -m physdev module).How can I filter packets that go through an ovs interface and put theminto different priority queues if I can not mark them with iptables?Rules (simplified):iptables -w -t mangle -A POSTROUTING -m physdev --physdev-out interface-name -m ttl --ttl-lt 10 ! -p 89 -j MARK --set-mark 10tc filter add dev interface-name parent 1:0 protocol all prio 1 handle 10 fw flowid 1:10Then I am using HTB for the priorities, lets say that there are two queues 1:10 and 1:20. The rule should send all the traffic with ttl < 10 and not OSPF to the first queue 1:10.
Alternative to Iptables for packet filtering in OVS interfaces
iptables;bridge;tc
That's an old problem. You'll have to know how your distro handles the netfilter kernel module. Sometimes it's loaded and the trick is to create a rule to mark them all then split afterwards. The mangle chain is kinda tricky.Add this as your first mark rule:iptables -t mangle -A POSTROUTING -m physdev --physdev-out interface-name -j MARK --set-mark 10A second issue is that your distro might not compile and/or load xt_mark kernel module. Use lsmod | grep xt_mark to check if it's there.I also have issues with OVS and iptables sometimes. I find iptables a great 90's tool, but I feel it kinda obsolete theses days. The check how your distro handle netfilter's module is very important to understand your problem.If you just want to mark your packages and iptables has no other purpose, you can use OVS tool called ovs-ofctl with pkt_mark option.