Re: [RFC] matching tproxied packets

[Balazs Scheidler <bazsi@balabit.hu>]

On Tue, Jun 04, 2002 at 05:14:47PM +0200, Henrik Nordstrom wrote:
> Balazs Scheidler wrote:
> 
> > * use a new state (called TPROXY), which would be applied to all TPROXYed
> >   packets (might interact badly with nat/conntrack).
> 
> It will in no doubt interact badly with connection tracking (and therefore 
> NAT).

ok.

> 
> > * have the tproxy framework mark all packets with an fwmark, and let the
> >   packets in based on the value of fwmark
> 
> Will interact badly with fwmark based routing.

of course the mark value would be controlled by the user, and not assigned
automatically.

> > * have a separate match (called tproxy), which matches tproxied sessions
> >   based on some value stored in the associated conntrack entry
> 
> Defenitely my preference, but I might be biased as I make heavy use of 
> connection tracking and fwmark based routing in combination.

This was my conclusion as well. So I'll go for this solution.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1