CLASSIFY target in POSTROUTING only?

CLASSIFY target in POSTROUTING only?

[Peter Lenci]

Hi all

The CLASSIFY extension can only be used in the POSTROUTING chain of the
mangle table. Is there a technical reason for this or is it just an aid
to prevent misconfiguration? In particular I'd like to use the CLASSIFY
target in the PREROUTING table (in combination with ingress tcp shaping
with the IMQ device).

Regards
Peter

______________________________________________________________________ 
Post your free ad now! http://personals.yahoo.ca

Re: CLASSIFY target in POSTROUTING only?

[Jonas Berlin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Peter Lenci wrote:

| Hi all

Hello there :)

| The CLASSIFY extension can only be used in the POSTROUTING chain of the
| mangle table. Is there a technical reason for this or is it just an aid
| to prevent misconfiguration? In particular I'd like to use the CLASSIFY
| target in the PREROUTING table (in combination with ingress tcp shaping
| with the IMQ device).

If you do the shaping on the IMQ device, I think you can do the shaping
in POSTROUTING, since the ingress shaping is done in the "egress" part
of the IMQ device anyway. You may have to configure the "AA AB BA BB"
IMQ setting in menuconfig for it to work though. If you can't figure it
out, I can try looking into it myself later when I have better time.

- --
- - xkr47
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCKEbFxyF48ZTvn+4RAu0jAJ9x99KPsNdNiJVMsDIE1vQGMsG5jQCeMeTP
mq61NBECGpTwJUo84vTXCc8=
=qSJP
-----END PGP SIGNATURE-----

Re: CLASSIFY target in POSTROUTING only?

[Patrick McHardy]

Peter Lenci wrote:
> Hi all
> 
> The CLASSIFY extension can only be used in the POSTROUTING chain of the
> mangle table. Is there a technical reason for this or is it just an aid
> to prevent misconfiguration? In particular I'd like to use the CLASSIFY
> target in the PREROUTING table (in combination with ingress tcp shaping
> with the IMQ device).

The CLASSIFY target is useable in LOCAL_OUT/FORWARD/POST_ROUTING.
PRE_ROUTING is not possible because the value will be overwritten
in ip_forward(). For IMQ you could simply remove that restriction.

Regards
Patrick