I'm migrating a legacy Debian setup to a new Ubuntu setup. I have previously set, in /etc/network/interfaces:

post-up /sbin/ip rule add fwmark 1 table table.tunnel
pre-down /sbin/ip rule del fwmark 1 table table.tunnel

Now that I'm on Ubuntu, it looks like I need to use netplan and the routing-policy section. Specifically, I think I should be able to use:

  version: 2
  renderer: networkd
  dhcp4: yes
  dhcp6: yes
   - table: 201
     fwmark: 1

Where table.tunnel is 201 in /etc/iproute2/rt_table. I've just upgraded to Ubuntu 18.04, as fwmark isn't documented as available in the netplan version included in 17.10.

When I try and apply the configuration, I get the error:

The overwriting error message was: Error in network definition 
  line 10 column 7: IP routing policy must include either a 'from' or 'to' IP
Error in network definition //etc/netplan/01-netcfg.yaml
  line 10 column 9: unknown key fwmark

It seems incorrect that I need to have a to/from in routing-policy (rather than routing) and this is suggested in man page:

routes (mapping)
          The  routes  block  defines  standard  static  routes   for   an
          interface.  At least to and via must be specified.
routing-policy (mapping)
          The  routing-policy  block  defines  extra  routing policy for a
          network, where traffic may be handled  specially  based  on  the
          source IP, firewall marking, etc.

Even if I put in a random to address, it still throws up the unknown key fwmark (even though this is stated in the man page).

Anyone got any thoughts?


This turns out to be a bug in netplan. I have reported this as an upstream bug report here: https://bugs.launchpad.net/netplan/+bug/1767955

  • Thanks. Changing the key 'fwmark' to 'mark' in the configuration is now accepted. It was also necessary to set "to:" and create a second entry for "to: ::/0" for IPv6 and my rules are working correctly. – Borg May 2 '18 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.