Re: [RFC] matching tproxied packets

[Henrik Nordstrom <hno@marasystems.com>]

Balazs Scheidler wrote:

> > Will interact badly with fwmark based routing.
>
> of course the mark value would be controlled by the user, and not assigned
> automatically.

As routing rules cannot mask fwmark, anything that touches the fwmark value 
for whatever purpose will affect your fwmark based routing.

The main purpose of fwmark is to communicate state between netfilter and other 
kernel parts such as routing, not as a storage within netfilter.

But sure, if all other uses of fmark supported masked operations then I would 
probably not object..

> > > * have a separate match (called tproxy), which matches tproxied
> > > sessions based on some value stored in the associated conntrack entry
> >
> > Defenitely my preference, but I might be biased as I make heavy use of
> > connection tracking and fwmark based routing in combination.
>
> This was my conclusion as well. So I'll go for this solution.

Good ;-)

Regards
Henrik