From: Stef Coene <stef.coene@docum.org>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] tc filter and fwmark
Date: Tue, 03 Dec 2002 10:39:50 +0000 [thread overview]
Message-ID: <marc-lartc-103893698520596@msgid-missing> (raw)
In-Reply-To: <marc-lartc-103882320212520@msgid-missing>
On Monday 02 December 2002 10:55, Andrei Boros wrote:
> Suppose:
>
> ipchains -A forward -s inside_net -d 0/0 -j MASQ -m 100
>
> (similar setup with iptables:
> iptables -A PREROUTING -t nat -s inside_net -d 0/0 -j SNAT
> iptables -A PREROUTING -t nat -s inside_net -d 0/0 -j MARK --set_mark
> 100)
>
> eth0 = outside iface
> eth1 = inside iface
>
> now:
> tc filter add dev eth0 ... handle 100 fw
> should catch packets marked by the above rule in ipchains (iptables).
>
> Ok. When the packet returns, the masq/nat code will find it in it's
> table and demasquerade it (as if by an invisible inverse rule).
> Question:
> Will the demasqueraded packets also bear the mark 100?
No. The mask only exists =ion the firewall. If a packet leaves the firewall,
the information is gone.
> And will
> tc filter add dev eth1 handle 100 fw
> Work?
No.
> I am probably missing something, as I haven't been able to make it work
> this way.
> Any suggestions, please?
> I want to shape the incoming traffic that I route for my inside network
> on the inside iface with queues and more complex shaping, rather then
> just a plain drop on the outside iface.
You have to mark the packets if they come from the internet. So the mark is
still available if you want to shape the packets if they leave eth1.
Stef
--
stef.coene@docum.org
"Using Linux as bandwidth manager"
http://www.docum.org/
#lartc @ irc.oftc.net
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
prev parent reply other threads:[~2002-12-03 10:39 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-12-02 9:55 [LARTC] tc filter and fwmark Andrei Boros
2002-12-03 10:39 ` Stef Coene [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-103893698520596@msgid-missing \
--to=stef.coene@docum.org \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.