[LARTC] Running in circles

[LARTC] Running in circles

[=?unknown-8bit?q?Drago=C2=BA_Cintez=C3=A3?=]

   Hy  lartc members,


  I  only  ACCEPT 7 IP's in FORWARD chain, filtering by IP and MAC.
  Everything worked fine  until i needed to forward ports. The problem is
  that the nat PREROUTING chain is traversed before the filter FORWARD
  chain  and  this  way  the  packets  change their source and are not
  allowed to pass FORWARD that is restricted to only 7 IPs.


  I use this rules to forward the port:
iptables -t nat -A PREROUTING -p tcp --dport <port> -i <external NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern>
iptables -t nat -A PREROUTING -p udp --dport <port> -i <external NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern>

and this on the FORWARD chain that has a default policy to DROP
iptables -A FORWARD -i <internal NIC> -s 192.168.1.1 -m mac --mac-source xx-xx-xx-xx-xx-xx -j ACCEPT

Can I identify the marked packets to use them in iptables rules? This would help in this situation because the pakets traverse first the mangle table, get marked, then traverse the nat table where the source ip is changed and in the filter table if would be posible to use the marks i wowld identify the packets even if the source ip is changed.

Regards

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/