Re: [PATCH] update for ROUTE target in Netfilter-Extension HOWTO [ENG][FR]

["Cédric de Launois" <delaunoi@info.ucl.ac.be>]

>   I want to be clear here... the ROUTE target lets me change the destination
> of a packet to be a specific interface, right?
Right, but the target also directly routes the packet to that interface.
That is, the packet does _not_ traverse the standard linux kernel
routing table, but is sent to the interface.

ASCII art may help :

Packets matching ROUTE target go directly from PREROUTING chain
to the interface.


          Regular routed Packet
---->PRE------>[kernel routes]--->FWD------->POST------>
      |                                            ^
      |                                            |
       `-------------------------------------------'
          Packets matching ROUTE target


Note that, if the interface is a tunnel, then the packet is
encapsulated, and this encapsulated packet then goes
through the OUPUT and POSTROUTING chains.

>   Does it continue through the rest of the table?
No, once the ROUTE target applies for a packet, the packet is 'stolen'.
No further rules are consulted.

> Could I, for instance, add QoS tags, or other stuff to it?
You can always mark a packet, add QoS tags and then, use
the ROUTE target applying on the marked packets.

> Could a later rule override the ROUTE again?
See 2nd question.

>   This is ideal for future FreeSWAN use.
If you tell me what exactly the problem is, I can even
add some features to help for this ;)

>   I agree that the interaction with NAT is confusing at present. 
The ROUTE target is now to be inserted in the mangle table.
This means that the ROUTE target applies before NAT (mangle
table has higher priority than nat table, but lower than
conntrack table).
So there is no longer interactions with the NAT.

Cédric