MARK and ! question

MARK and ! question

[Ruslan Spivak]

Hello.

I need to mark with value 107 packets that are going NOT from the 
193.220.70.0/27 network and NOT from the 193.108.240.0/22 network.
Is it possible?

Below two lines seem not to work properly because second rule won't be 
reached.

iptables -t mangle -A POSTROUTING -s ! 193.220.70.0/27 -d 
193.220.70.32/27 -j MARK --set-mark 107

iptables -t mangle -A POSTROUTING -s ! 193.108.240.0/22 -d 
193.220.70.32/27 -j MARK --set-mark 107

Your help is very, very appreciated.

Best regards,
Ruslan

Re: MARK and ! question

[Sven Schuster]

What about using a user-defined chain like this:

iptables -t mangle -N setmark
iptables -t mangle -A setmark -s ! 193.220.70.0/27 -d 193.220.70.32/27 \
         -j RETURN
iptables -t mangle -A setmark -s ! 193.108.240.0/22 -d 193.220.70.32/27 \
         -j RETURN
iptables -t mangle -A setmark -j MARK --set-mark 107
iptables -t mangle -A POSTROUTING -j setmark

Hope this helps

Sven


Ruslan Spivak wrote:

> Hello.
>
> I need to mark with value 107 packets that are going NOT from the 
> 193.220.70.0/27 network and NOT from the 193.108.240.0/22 network.
> Is it possible?
>
> Below two lines seem not to work properly because second rule won't be 
> reached.
>
> iptables -t mangle -A POSTROUTING -s ! 193.220.70.0/27 -d 
> 193.220.70.32/27 -j MARK --set-mark 107
>
> iptables -t mangle -A POSTROUTING -s ! 193.108.240.0/22 -d 
> 193.220.70.32/27 -j MARK --set-mark 107
>
> Your help is very, very appreciated.
>
> Best regards,
> Ruslan
>
>
>

Re: MARK and ! question

[Ruslan Spivak]

Sven Schuster wrote:

>
> What about using a user-defined chain like this:
>
> iptables -t mangle -N setmark
> iptables -t mangle -A setmark -s ! 193.220.70.0/27 -d 193.220.70.32/27 \
>         -j RETURN
> iptables -t mangle -A setmark -s ! 193.108.240.0/22 -d 193.220.70.32/27 \
>         -j RETURN
> iptables -t mangle -A setmark -j MARK --set-mark 107
> iptables -t mangle -A POSTROUTING -j setmark
>
> Hope this helps
>
> Sven

Thanks for your reply.
And can you describe how packet traverses such chain?
Thanks in advance,
Ruslan

>
>
> Ruslan Spivak wrote:
>
>> Hello.
>>
>> I need to mark with value 107 packets that are going NOT from the 
>> 193.220.70.0/27 network and NOT from the 193.108.240.0/22 network.
>> Is it possible?
>>
>> Below two lines seem not to work properly because second rule won't 
>> be reached.
>>
>> iptables -t mangle -A POSTROUTING -s ! 193.220.70.0/27 -d 
>> 193.220.70.32/27 -j MARK --set-mark 107
>>
>> iptables -t mangle -A POSTROUTING -s ! 193.108.240.0/22 -d 
>> 193.220.70.32/27 -j MARK --set-mark 107
>>
>> Your help is very, very appreciated.
>>
>> Best regards,
>> Ruslan
>>
>>
>>
>

Re: MARK and ! question

[Chris Wilson]

Hi Ruslan, Hi Sven,

> > What about using a user-defined chain like this:
> >
> > iptables -t mangle -N setmark
> > iptables -t mangle -A setmark -s ! 193.220.70.0/27 -d 193.220.70.32/27 \
> >         -j RETURN
> > iptables -t mangle -A setmark -s ! 193.108.240.0/22 -d 193.220.70.32/27 \
> >         -j RETURN
> > iptables -t mangle -A setmark -j MARK --set-mark 107
> > iptables -t mangle -A POSTROUTING -j setmark

> Thanks for your reply.
> And can you describe how packet traverses such chain?

I think the ruleset above is wrong: the '!' should not be present here. 
Allow me to explain the packet traversal when the same rules are used, but 
with "!" removed:

iptables -t mangle -N setmark
iptables -t mangle -A setmark -s 193.220.70.0/27 -d 193.220.70.32/27 \
        -j RETURN
iptables -t mangle -A setmark -s 193.108.240.0/22 -d 193.220.70.32/27 \
        -j RETURN
iptables -t mangle -A setmark -j MARK --set-mark 107
iptables -t mangle -A POSTROUTING -j setmark

1. Packet enters POSTROUTING
2. Packet jumps to "setmark" chain
3. Packets having source address matching "193.220.70.0/27" are RETURNed 
   to POSTROUTING
4. Packets having source address matching "193.108.240.0/22" are RETURNed 
   to POSTROUTING
5. (now ONLY packets which do NOT have either of these source addresses 
   are still in the "setmark" chain)
6. All packets (still in the "setmark" chain) are marked with 107
7. Packets fall off the end of the "setmark" chain and return to 
   POSTROUTING (but they are now marked)
8. Packets fall of the end of POSTROUTING and continue through the kernel 
   (presumably to be delivered to a network device)

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |

Re: MARK and ! question

[Sven Schuster]

Chris Wilson wrote:

>I think the ruleset above is wrong: the '!' should not be present here. 
>Allow me to explain the packet traversal when the same rules are used, but 
>with "!" removed:
>
>
Yeah you're right, sorry...need more coffee ;-))

>iptables -t mangle -N setmark
>iptables -t mangle -A setmark -s 193.220.70.0/27 -d 193.220.70.32/27 \
>        -j RETURN
>iptables -t mangle -A setmark -s 193.108.240.0/22 -d 193.220.70.32/27 \
>        -j RETURN
>iptables -t mangle -A setmark -j MARK --set-mark 107
>iptables -t mangle -A POSTROUTING -j setmark
>
>1. Packet enters POSTROUTING
>2. Packet jumps to "setmark" chain
>3. Packets having source address matching "193.220.70.0/27" are RETURNed 
>   to POSTROUTING
>4. Packets having source address matching "193.108.240.0/22" are RETURNed 
>   to POSTROUTING
>5. (now ONLY packets which do NOT have either of these source addresses 
>   are still in the "setmark" chain)
>6. All packets (still in the "setmark" chain) are marked with 107
>7. Packets fall off the end of the "setmark" chain and return to 
>   POSTROUTING (but they are now marked)
>8. Packets fall of the end of POSTROUTING and continue through the kernel 
>   (presumably to be delivered to a network device)
>
>Cheers, Chris.
>

Sven

Re: MARK and ! question

[Ruslan Spivak]

Chris Wilson wrote:

>Hi Ruslan, Hi Sven,
>
>  
>
>>>What about using a user-defined chain like this:
>>>
>>>iptables -t mangle -N setmark
>>>iptables -t mangle -A setmark -s ! 193.220.70.0/27 -d 193.220.70.32/27 \
>>>        -j RETURN
>>>iptables -t mangle -A setmark -s ! 193.108.240.0/22 -d 193.220.70.32/27 \
>>>        -j RETURN
>>>iptables -t mangle -A setmark -j MARK --set-mark 107
>>>iptables -t mangle -A POSTROUTING -j setmark
>>>      
>>>
>
>  
>
>>Thanks for your reply.
>>And can you describe how packet traverses such chain?
>>    
>>
>
>I think the ruleset above is wrong: the '!' should not be present here. 
>Allow me to explain the packet traversal when the same rules are used, but 
>with "!" removed:
>
>iptables -t mangle -N setmark
>iptables -t mangle -A setmark -s 193.220.70.0/27 -d 193.220.70.32/27 \
>        -j RETURN
>iptables -t mangle -A setmark -s 193.108.240.0/22 -d 193.220.70.32/27 \
>        -j RETURN
>iptables -t mangle -A setmark -j MARK --set-mark 107
>iptables -t mangle -A POSTROUTING -j setmark
>
>1. Packet enters POSTROUTING
>2. Packet jumps to "setmark" chain
>3. Packets having source address matching "193.220.70.0/27" are RETURNed 
>   to POSTROUTING
>4. Packets having source address matching "193.108.240.0/22" are RETURNed 
>   to POSTROUTING
>5. (now ONLY packets which do NOT have either of these source addresses 
>   are still in the "setmark" chain)
>6. All packets (still in the "setmark" chain) are marked with 107
>7. Packets fall off the end of the "setmark" chain and return to 
>   POSTROUTING (but they are now marked)
>8. Packets fall of the end of POSTROUTING and continue through the kernel 
>   (presumably to be delivered to a network device)
>
>Cheers, Chris.
>  
>
Sorry for disturbance, but one more question: it looks like all other 
packets not from

193.220.70.0/27 and not from 193.108.240.0/22 will be marked, but i need mark packets that have destination 193.220.70.32/27 and not from above mentioned networks. What else should i add or modify?

Thanks in advance.

Re: MARK and ! question

[Chris Wilson]

Hi Ruslan,

> Sorry for disturbance, but one more question: it looks like all other 
> packets not from
> 
> 193.220.70.0/27 and not from 193.108.240.0/22 will be marked, but i need
> mark packets that have destination 193.220.70.32/27 and not from above
> mentioned networks. What else should i add or modify?

Sorry, it looks like the ruleset is still wrong. Try this one:

iptables -t mangle -N setmark
iptables -t mangle -A setmark -s   193.220.70.0/27  -j RETURN
iptables -t mangle -A setmark -s   193.108.240.0/22 -j RETURN
iptables -t mangle -A setmark -d ! 193.220.70.32/27 -j RETURN
iptables -t mangle -A setmark -j MARK --set-mark 107
iptables -t mangle -A POSTROUTING -j setmark

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |

Re: MARK and ! question

[Sven Schuster]

1. Paket arrives at mangle/POSTROUTING
2. Paket jumps from POSTROUTING chain to setmark chain
3. When the the pakets' source is _not_ 193.220.70.0/27 the paket
   will return to mangle/POSTROUTING and continue traversal.
4. When the the pakets' source is _not_ 193.108.240.0/22 the paket
   will return to mangle/POSTROUTING and continue traversal.
5. So now we have pakets neither coming from 193.220.70.0/24
   nor from 193.108.240.0/22. And those pakets are MARKED with
   the value 107.

Hope this is enough for you ;-)

Have a nice day

Sven



Ruslan Spivak wrote:

> Sven Schuster wrote:
>
>>
>> What about using a user-defined chain like this:
>>
>> iptables -t mangle -N setmark
>> iptables -t mangle -A setmark -s ! 193.220.70.0/27 -d 193.220.70.32/27 \
>>         -j RETURN
>> iptables -t mangle -A setmark -s ! 193.108.240.0/22 -d 
>> 193.220.70.32/27 \
>>         -j RETURN
>> iptables -t mangle -A setmark -j MARK --set-mark 107
>> iptables -t mangle -A POSTROUTING -j setmark
>>
>> Hope this helps
>>
>> Sven
>
>
> Thanks for your reply.
> And can you describe how packet traverses such chain?
> Thanks in advance,
> Ruslan
>