Using iptables CONNMARK target and match in filter table

Using iptables CONNMARK target and match in filter table

[Ratnaraj Mirgal]

Hi all,

I'm trying use CONNMARK to bypass rules for established connections.
I'm using only filter table and also not using MARK, since iproute is
not used to mark the packet.

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:cmchain - [0:0]
:inbound - [0:0]
:outbound - [0:0]
-A INPUT -m connmark ! --mark 0x0 -j ACCEPT
-A INPUT -j inbound
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j cmchain
-A OUTPUT -m connmark ! --mark 0x0 -j ACCEPT
-A OUTPUT -j outbound
-A cmchain -j CONNMARK --set-xmark 0x1/0xffffffff
-A cmchain -j ACCEPT
COMMIT

as you can see, inbound chain contains incoming traffic rules, while
outbound chain contains outbound traffic rules.

i'm trying to bypass inbound rules with checking connection mark for
non-zero. This condition is under the assumption that
skb->nfct is getting populated in prerouting hook in kernel.
Similarly thing i'm doing to bypass outbound rules for established connection.

But this implementation is not working since inbound rules are still
getting traversed for a established connection.

seems like i'm missing some step.

Please help me understand where i'm going wrong.

TIA


-- 
Warm Regards,
Ratnaraj Mirgal
http://www.google.co.in/search?q=ratnaraj+mirgal
:-)