From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dimitris Kotsonis Date: Sat, 08 Jan 2005 09:48:18 +0000 Subject: Re: [LARTC] Marking ftp inbound traffic is impossible ? Message-Id: <41DFAC62.6090309@pwn.emphyrio.org> List-Id: References: <20050108075557.73544.qmail@web51605.mail.yahoo.com> In-Reply-To: <20050108075557.73544.qmail@web51605.mail.yahoo.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org ngo giang wrote: > Hello, > > I searched the archives mailing list of LARTC. Everyone discussed about > marking outbound ftp > > traffic . I could not find any thread discussed about marking inbound > ftp traffic. > > With inbound ftp traffic , we don't know the random ports specified by > ftp servers in passive mode ? > > So marking inbound ftp traffic is impossible ? > > If it is possible, can you tell me, > > Thanks in advance, > > nhgiang Use CONNMARK and owner match. For example, to mark incoming and ougoing packets of vsftpd with fwmark 12 use the following ... iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark iptables -t mangle -A OUTPUT -m owner --cmd-owner vsftpd -j MARK-set-mark 12 iptables -t mangle -A OUTPUT -j CONNMARK --save-mark _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/