From: Philip Craig <philipc@snapgear.com>
To: kaiwen <cal_kaiwen@hotmail.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: Match packet mark with --set-mark to ip rule fwmark
Date: Wed, 07 Jan 2004 15:00:43 +1000 [thread overview]
Message-ID: <3FFB927B.4010208@snapgear.com> (raw)
In-Reply-To: <Law11-OE68Dt3HvoFOA00000021@hotmail.com>
kaiwen wrote:
> (3) [root@g webauth]# ip ro show table test2
> prohibit 192.168.8.122
>
> I expect ping from 192.168.8.122 to 192.168.250.197 to be drop, BUT is is
> successful. Why?
> Did I miss out anything? Please advice.
prohibit specifies the destination address, not the source. So the ping
from 192.168.8.122 to 192.168.250.197 will get through. Additionally,
the reply goes through OUTPUT, not PREROUTING, so it won't be marked and
dropped either. If you add your mark rule to the OUTPUT chain, then you
should see the reply being dropped.
I assume you are just using prohibit for testing: there is no point
marking a packet with iptables and then dropping it iproute2, when you
could just drop it with iptables in the first place.
--
Philip Craig - SnapGear, A CyberGuard Company - http://www.SnapGear.com
next prev parent reply other threads:[~2004-01-07 5:00 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-01-07 4:10 Match packet mark with --set-mark to ip rule fwmark kaiwen
2004-01-07 5:00 ` Philip Craig [this message]
2004-01-07 5:03 ` kaiwen
2004-01-07 5:35 ` kaiwen
2004-01-07 6:17 ` Philip Craig
2004-01-07 7:25 ` kaiwen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FFB927B.4010208@snapgear.com \
--to=philipc@snapgear.com \
--cc=cal_kaiwen@hotmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.