Re: "Late REDIRECT"

[Menno Smits <menno@netboxblue.com>]

Hi Pablo,

Pablo Neira Ayuso wrote:
>>
>> Is something like this feasible? How difficult would it be implement? Am
>> I barking up the wrong tree?
> 
> Ick, this seems frigthening. Why don't you filter in the raw PREROUTING?

Two reasons:

1) You can't do REJECT in raw, only DROP.

2) You still need to use convoluted rules to figure out where packets 
are going to go. In the filter table you know what's being forwarded and 
what is local and in filter FORWARD you know both the source and 
destination interface. Currently we use an intricate arrangement of 
chains and rules in mangle PREROUTING to determine the marks to set 
based on the known IPs, networks and routes for each interface. Packets 
then get handled according to their marks in the filter and nat tables.

Regards,
Menno



Scanned by the NetBox from NetBox Blue
(http://netboxblue.com/)