[LARTC] about fw marks on netfilter

[LARTC] about fw marks on netfilter

[Rio Martin.]

Dear all,
Is it okay if i put many different rules on single mark.
example:

iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp -s 192.168.2.0/24 -j MARK --set-mark 1
...
iptables -t mangle -A PREROUTING -p tcp -s 192.168.10.0/24 -j MARK--set-mark 1

Regards,
Rio Martin.
-- 
Q:  How many mathematicians does it take to screw in a lightbulb?
A:  One.  He gives it to six Californians, thereby reducing the problem
    to the earlier joke.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] about fw marks on netfilter

[Jose Luis Domingo Lopez]

On Saturday, 26 July 2003, at 11:56:55 +0700,
Rio Martin. wrote:

> Is it okay if i put many different rules on single mark.
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.0/24 -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.2.0/24 -j MARK --set-mark 1
> ...
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.10.0/24 -j MARK--set-mark 1
> 
What you show is perfectly legal with iptables/netfilter. MARK target
just associates some number (the mark) to the packets it applies to, and
this mark travels along the (inmodified) packet all its way through the
linux kernel (that it, marks won't propagate trough the network, the
have just local significance).

Don't forget to do "iptables --match mark --mark 1 --jump ACCEPT" or
whatever as soon as possible, because a later "--set-mark 2" would
overwrite the previously set mark.

Regards,

-- 
Jose Luis Domingo Lopez
Linux Registered User #189436     Debian Linux Sid (Linux 2.6.0-test1)
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/