I have the following iptables rule:iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffffwhich sets fwmark 4 on all udp packets with destination port 10000. I forward it to a tunnel (without any nat) with policy-based routing:[root@localhost ~]# ip rule0:  from all fwmark 0x4/0x4 lookup 87 32765:  from all lookup local 32766:  from all lookup main 32767:  from all lookup default [root@localhost ~]# ip route show table 87default dev tunnel  scope link Everything works correctly if the packet comes from a normal NIC (eth0 etc.), but packets that travel on the loopback interface (lo, for example packets generated with socat -u - UDP:localhost:10000) seem to skip the routing decision after the PREROUTING chain, and get received by the local host (which in fact replies with an ICMP port unreachable packet over the lo interface).Is this expected behavior? If so how can I workaround that? I need packets not to have different paths for different input devices, as I want to use lo to test my more complex iptables ruleset (that is, an extra rule with nat won't be a solution for me).
Forwarding packets from loopback interface with policy-based routing
iptables;routing;port forwarding;tunneling