From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jose Luis Domingo Lopez Date: Sat, 26 Jul 2003 12:12:21 +0000 Subject: Re: [LARTC] about fw marks on netfilter Message-Id: List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org On Saturday, 26 July 2003, at 11:56:55 +0700, Rio Martin. wrote: > Is it okay if i put many different rules on single mark. > iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.0/24 -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -p tcp -s 192.168.2.0/24 -j MARK --set-mark 1 > ... > iptables -t mangle -A PREROUTING -p tcp -s 192.168.10.0/24 -j MARK--set-mark 1 > What you show is perfectly legal with iptables/netfilter. MARK target just associates some number (the mark) to the packets it applies to, and this mark travels along the (inmodified) packet all its way through the linux kernel (that it, marks won't propagate trough the network, the have just local significance). Don't forget to do "iptables --match mark --mark 1 --jump ACCEPT" or whatever as soon as possible, because a later "--set-mark 2" would overwrite the previously set mark. Regards, -- Jose Luis Domingo Lopez Linux Registered User #189436 Debian Linux Sid (Linux 2.6.0-test1) _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/