[LARTC] Marks not working...

[LARTC] Marks not working...

[tomdeb]

Hi,

I am experimenting a little bit with my firewall and I don't seem to get
my head round marks ...

I try to mark p2p packets generated on the firewall in the output chain
and then try to match that mark either in NAT OUTPUT or POSTROUTING

I don't seem to get the expected result. 

Any help or clue would be more than welcome.


root@droopy:~/firewall > iptables-view -t mangle
Chain PREROUTING (policy ACCEPT 33890 packets, 16M bytes) num   pkts bytes target     prot opt in     out     source destination

Chain INPUT (policy ACCEPT 24751 packets, 12M bytes) num   pkts bytes target     prot opt in     out     source destination

Chain FORWARD (policy ACCEPT 9146 packets, 4557K bytes) num   pkts bytes target     prot opt in     out     source destination

Chain OUTPUT (policy ACCEPT 59M packets, 61G bytes) num   pkts bytes target     prot opt in     out     source destination
1        3   324 LOG        0    --  *      *       0.0.0.0/0 0.0.0.0/0           ipp2p v0.8.2 --ipp2p LOG flags 0 level 4 prefix ` OUT IPP2P '
2        3   324 MARK       0    --  *      *       0.0.0.0/0 0.0.0.0/0           ipp2p v0.8.2 --ipp2p MARK set 0x2

Chain POSTROUTING (policy ACCEPT 32911 packets, 7397K bytes) num   pkts bytes target     prot opt in     out     source destination
root@droopy:~/firewall > iptables-view -t nat
Chain PREROUTING (policy ACCEPT 973 packets, 62249 bytes) num   pkts bytes target     prot opt in     out     source destination

Chain POSTROUTING (policy ACCEPT 227 packets, 14178 bytes) num   pkts bytes target     prot opt in     out     source destination
1        0     0 LOG        0    --  *      *       0.0.0.0/0 0.0.0.0/0           MARK match 0x2 LOG flags 0 level 4 prefix ` MARK IPP2P '

Chain OUTPUT (policy ACCEPT 226 packets, 14172 bytes) num   pkts bytes target     prot opt in     out     source destination`
1        0     0 LOG        0    --  *      *       0.0.0.0/0 0.0.0.0/0           MARK match 0x2 LOG flags 0 level 4 prefix ` MARK IPP2P '

T o M

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Marks not working...

[Andrew Beverley]

Are you using your firewall as a router, ie is the p2p traffic coming
from another PC through the firewall?

If so, I think your rules need to go in the FORWARD chain not in the
OUTPUT chain.

Another thing to remember is that ipp2p is not 100% reliable at
matching. Have you tried something simpler first such as matching on
source address?

Andy Beverley


On Sat, 2007-02-03 at 01:44 +0000, tomdeb wrote:
> Hi,
> 
> I am experimenting a little bit with my firewall and I don't seem to get
> my head round marks ...
> 
> I try to mark p2p packets generated on the firewall in the output chain
> and then try to match that mark either in NAT OUTPUT or POSTROUTING
> 
> I don't seem to get the expected result. 
> 
> Any help or clue would be more than welcome.
> 
> 
> root@droopy:~/firewall > iptables-view -t mangle
> Chain PREROUTING (policy ACCEPT 33890 packets, 16M bytes) num   pkts bytes target     prot opt in     out     source destination
> 
> Chain INPUT (policy ACCEPT 24751 packets, 12M bytes) num   pkts bytes target     prot opt in     out     source destination
> 
> Chain FORWARD (policy ACCEPT 9146 packets, 4557K bytes) num   pkts bytes target     prot opt in     out     source destination
> 
> Chain OUTPUT (policy ACCEPT 59M packets, 61G bytes) num   pkts bytes target     prot opt in     out     source destination
> 1        3   324 LOG        0    --  *      *       0.0.0.0/0 0.0.0.0/0           ipp2p v0.8.2 --ipp2p LOG flags 0 level 4 prefix ` OUT IPP2P '
> 2        3   324 MARK       0    --  *      *       0.0.0.0/0 0.0.0.0/0           ipp2p v0.8.2 --ipp2p MARK set 0x2
> 
> Chain POSTROUTING (policy ACCEPT 32911 packets, 7397K bytes) num   pkts bytes target     prot opt in     out     source destination
> root@droopy:~/firewall > iptables-view -t nat
> Chain PREROUTING (policy ACCEPT 973 packets, 62249 bytes) num   pkts bytes target     prot opt in     out     source destination
> 
> Chain POSTROUTING (policy ACCEPT 227 packets, 14178 bytes) num   pkts bytes target     prot opt in     out     source destination
> 1        0     0 LOG        0    --  *      *       0.0.0.0/0 0.0.0.0/0           MARK match 0x2 LOG flags 0 level 4 prefix ` MARK IPP2P '
> 
> Chain OUTPUT (policy ACCEPT 226 packets, 14172 bytes) num   pkts bytes target     prot opt in     out     source destination`
> 1        0     0 LOG        0    --  *      *       0.0.0.0/0 0.0.0.0/0           MARK match 0x2 LOG flags 0 level 4 prefix ` MARK IPP2P '
> 
> T o M
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc