Re: bidirectional CONNMARK?

[Wang Jian <lark@linux.net.cn>]

Hi,

I have figured out how to do it with CONNMARK. Using --mask, I can
choose bits to use.

My iptables 1.2.9 doesn't give hint on mask for --set-mark, --save-mark
and --restore-mask. I just read the code from HEAD and realize.

I am happy. Thanks.

On Wed, 09 Mar 2005 13:26:19 +0800, Wang Jian <lark@linux.net.cn> wrote:

> Hi folks,
> 
> What is the CONNMARK's purpose? I think it is to reduce rule traversal,
> like this:
> 
> # iptables -A PREROUTING -t mangle \
>    -m connmark --mark 0xEF000000/0xFF000000 -j CONNMARK --restore-mark
> 
> # iptables -A PREROUTING -t mangle <matching rule 1-1> -j CONNMARK --set-mark 0xEF000001
> # iptables -A PREROUTING -t mangle <matching rule 1-2> -j CONNMARK --set-mark 0xEF000001
> # iptables -A PREROUTING -t mangle <matching rule 1-3> -j CONNMARK --set-mark 0xEF000001
> # iptables -A PREROUTING -t mangle <matching rule 2-1> -j CONNMARK --set-mark 0xEF000002
> # iptables -A PREROUTING -t mangle <matching rule 3-1> -j CONNMARK --set-mark 0xEF000003
> <snip a lot of rules>
> 
> But an issue occurs, when we want to set 2 different marks for a single
> session in two directions.
> 
> When doing QoS control as an router between two or more interfaces,
> bi-directional control is neccessary. Since nfmark is the most
> convenient way to classify packet, should we extend CONNMARK to support
> two marks?
> 
> Comment on this issue is welcome.
> 
> If it is a good idea, I will provide a patch for it.
> 
> 
> 
> 
> -- 
>   lark
> 



-- 
  lark