All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tadas <tadas@silvernet.homeip.net>
To: lartc@vger.kernel.org
Subject: [LARTC] iptables mangle table
Date: Thu, 13 Jun 2002 15:20:25 +0000	[thread overview]
Message-ID: <marc-lartc-102398193820638@msgid-missing> (raw)

Hello,

I can't understand clearly how packets traverse mangle table under
iptables (kernel 2.4.18). I would like to match all ACK and SYN packets. There is local
servies and masquerading. So, I wrote such filters:

iptables -t mangle -A OUTPUT -o $PPP -p tcp -m tcp --tcp-flags SYN SYN -j MARK --set-mark 0
iptables -t mangle -A INPUT -p tcp -m tcp --tcp-flags SYN SYN -j MARK --set-mark 0
iptables -t mangle -A PREROUTING -p tcp -m tcp --tcp-flags SYN SYN -j MARK --set-mark 0

iptables -t mangle -A OUTPUT -o $PPP -p tcp -m tcp --tcp-flags ACK ACK -j MARK --set-mark 0
iptables -t mangle -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j MARK --set-mark 0
iptables -t mangle -A PREROUTING -p tcp -m tcp --tcp-flags ACK ACK -j MARK --set-mark 0


iptablles -L -v -t mangle shows me:
########################
Chain PREROUTING (policy ACCEPT 8643 packets, 1826K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   300 MARK       tcp  --  any    any     anywhere             anywhere           tcp flags:SYN/SYN MARK set 0xc8 
 1263  215K MARK       tcp  --  any    any     anywhere             anywhere           tcp flags:ACK/ACK MARK set 0xc8 
   15  2610 MARK       udp  --  eth0   any     anywhere             anywhere           udp spt:domain MARK set 0xc8 
    0     0 MARK       udp  --  any    any     anywhere             anywhere           udp dpt:domain MARK set 0xc8 
 1985  283K IMQ        all  --  eth0   any     anywhere             anywhere           IMQ: todev 0 

Chain INPUT (policy ACCEPT 8643 packets, 1826K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   300 MARK       tcp  --  any    any     anywhere             anywhere           tcp flags:SYN/SYN MARK set 0xc8 
 1263  215K MARK       tcp  --  any    any     anywhere             anywhere           tcp flags:ACK/ACK MARK set 0xc8 
    0     0 MARK       tcp  --  eth0   any     proxy.takas.lt       anywhere           tcp spt:webcache MARK set 0x12c 
    0     0 MARK       tcp  --  eth0   any     anywhere             anywhere           tcp spt:www MARK set 0x12c 
   15  2610 MARK       udp  --  eth0   any     anywhere             anywhere           udp spt:domain MARK set 0xc8 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4513 packets, 373K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   300 MARK       tcp  --  any    eth0    anywhere             anywhere           tcp flags:SYN/SYN MARK set 0xc8 
 1843  155K MARK       tcp  --  any    eth0    anywhere             anywhere           tcp flags:ACK/ACK MARK set 0xc8 
    0     0 MARK       tcp  --  any    eth0    anywhere             proxy.takas.lt     tcp dpt:webcache MARK set 0x12c 
    0     0 MARK       tcp  --  any    eth0    anywhere             proxy.takas.lt     tcp dpt:www MARK set 0x12c 
   15  1050 MARK       udp  --  any    any     anywhere             anywhere           udp dpt:domain MARK set 0xc8 

Chain POSTROUTING (policy ACCEPT 4600 packets, 383K bytes)
 pkts bytes target     prot opt in     out     source               destination
#####################

I noticed that SYN packet count is the same on all of the chains. ACK is the
same on the PREROUTING and and INPUT. So, what is the scheme?

By the way, what happens when packets enters IMQ target? Logically, it
is queued in the imq0 device and traverses all filters as new packet,
isn't it?

Bye,
Tadas
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

                 reply	other threads:[~2002-06-13 15:20 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-102398193820638@msgid-missing \
    --to=tadas@silvernet.homeip.net \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.