iptables dnat, ebtables, mark

[Moritz Gartenmeister <moritz.gartenmeister@access.unizh.ch>]

hi

my idea:
i know the mac-adress from a compromised computer in my lan. i want to redirect all the traffic from 
this computer to a webserver (to show up a page with e.g. "bad guy! you got a virus").

my system:
debian testing 2.6.7
iptables
ebtables
bridge-code

my solution so far:
ebtables -t nat -A PREROUTING -s $MAC -j mark --set-mark 8 --mark-target CONTINUE
there are no other rules in this chain.
some more rules in -A FORWARD all with -s macadress, but not the one above.

is the only rule in prerouting nat.
iptables -t nat -A PREROUTING -m mark --mark 0x8 -j DNAT --to-destination $IP-WWW

is the first role in the mangle chain.
iptables -t mangle -A PREROUTING -m mark --mark 0x8 -j ACCEPT

one check rule in mangl POSTROUTING
iptables -t mangle -A POSTROUTING -m -mark --makr 0x8 -j LOG --log-prefix IPT_MARK

my problem:
the user can access the webserver and only this server, but the user is not redirected to the 
web-server, if he tries to access e.g. www.google.com. he only get an error-message.

my observation:
number of packets differ...
ebtables 213 packets
prerouting mangle 200 packets
prerouting nat 118 packets
postrouting mangle 93 packets

any explanations? the number should be at least the same. i don't understand this. the filter-rules 
seem to work properly...

cheers
moritz