From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?unknown-8bit?q?Drago=C2=BA_Cintez=C3=A3?= Date: Sun, 12 Oct 2003 02:22:04 +0000 Subject: [LARTC] Running in circles Message-Id: List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org Hy lartc members, I only ACCEPT 7 IP's in FORWARD chain, filtering by IP and MAC. Everything worked fine until i needed to forward ports. The problem is that the nat PREROUTING chain is traversed before the filter FORWARD chain and this way the packets change their source and are not allowed to pass FORWARD that is restricted to only 7 IPs. I use this rules to forward the port: iptables -t nat -A PREROUTING -p tcp --dport -i -j DNAT --to : -d iptables -t nat -A PREROUTING -p udp --dport -i -j DNAT --to : -d and this on the FORWARD chain that has a default policy to DROP iptables -A FORWARD -i -s 192.168.1.1 -m mac --mac-source xx-xx-xx-xx-xx-xx -j ACCEPT Can I identify the marked packets to use them in iptables rules? This would help in this situation because the pakets traverse first the mangle table, get marked, then traverse the nat table where the source ip is changed and in the filter table if would be posible to use the marks i wowld identify the packets even if the source ip is changed. Regards _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/