MARK extension

MARK extension

[Thomas Woerner]

Hello,

according to the man page MARK "can only be used in the mangle table". 
But this is not correct. It is possible to use it also in the nat table.

Is this a documentation problem?

Working example:

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth+ -p tcp --dport 4711 -j MARK --set-mark 0x65
-A PREROUTING -i eth+ -p tcp --dport 4711 -m mark --mark 0x65 -j DNAT 
--to-destination :80
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -m state --state NEW -m tcp -p tcp --dport 80 -m mark 
--mark 0x65 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Thanks,
Thomas

-- 
Thomas Woerner
Software Engineer            Phone: +49-711-96437-310
Red Hat GmbH                 Fax  : +49-711-96437-111
Hauptstaetterstr. 58         Email: Thomas Woerner <twoerner@redhat.com>
D-70178 Stuttgart            Web  : http://www.redhat.de/

Re: MARK extension

[Patrick McHardy]

Thomas Woerner wrote:
> Hello,
> 
> according to the man page MARK "can only be used in the mangle table".
> But this is not correct. It is possible to use it also in the nat table.
> 
> Is this a documentation problem?

It seems that way. It probably should state "MARK can only be used
for output routing in the mangle table".