Re: target MARK in filter table?

[Patrick Schaaf <bof@bof.de>]

On Tue, Jul 15, 2003 at 08:26:17AM +0400, Poltorak Serguei wrote:
> ;The idea is to have targets for filtering in the filter table - and
> ;anything that modifies the packet [or potentially affect other kernel
> ;subsystems such as policy routing] in 'mangle'.
> And if I'm using fwmark mechanism not to change packet, but to
> mark it and remember that this one I need to treat differantly.
> 
> May be you know a better way to do it...

The workaround that I used in some situations, was to create suitable
classification chains at mangle/PREROUTING, which set MARK values,
and then consistently match these marks in the filter table, instead
of using various criteria directly.

It is a bad workaround, because it complicates the ruleset by one layer.
In the filter table, I can no longer locally see _when_ something is done,
only _what_ is done; for the full picture, I have to jump back and forth
between reading filter and mangle chains.

This is bearable, but not really nice.

> I think fwmark is very usefull not only with routing and qos to tell what
> to change/mangle/nat/... It makes iptables more programmable :)

Exactly my feeling.

best regards
  Patrick