mangle table question

mangle table question

[Jason Sigurdur]

Hi, I have the following rules:

 

iptables -t mangle -A FORWARD -o net+ -p tcp --dport 3389 -j DSCP
--set-dscp-class af31

iptables -t mangle -A FORWARD -o net+ -p tcp --sport 3389 -j DSCP
--set-dscp-class af31

iptables -t mangle -A FORWARD -o net+ -p tcp --dport 23 -j DSCP
--set-dscp-class af31

iptables -t mangle -A FORWARD -o net+ -p tcp --sport 23 -j DSCP
--set-dscp-class af31

iptables -t mangle -A FORWARD -o net+ -p tcp --dport 25 -j DSCP
--set-dscp-class af31

iptables -t mangle -A FORWARD -o net+  -j DSCP --set-dscp-class af11

 

 

If the last rule is enabled, it resets all the DSCP values to af11. If a
specific rule is matched, does it not exit the chain?

 

jason

 

Re: mangle table question

[Pascal Hambourg]

Hello,

Jason Sigurdur a écrit :
> 
> If a specific rule is matched, does it not exit the chain?

Only if the target is "terminal". ACCEPT, DROP, REJECT are terminal. 
NAT-specific targets such as SNAT and DNAT are terminal too. LOG is 
obviously not terminal. Most if not all mangle-specific targets such as 
DSCP are not terminal. Indeed one may want to alter several parts of a 
packet in the same chain.

Re: mangle table question

[Matt Zagrabelny]

[-- Attachment #1: Type: text/plain, Size: 1109 bytes --]


On Wed, 2007-10-31 at 16:23 +0100, Pascal Hambourg wrote:
> Hello,
> 
> Jason Sigurdur a écrit :
> > 
> > If a specific rule is matched, does it not exit the chain?
> 
> Only if the target is "terminal". ACCEPT, DROP, REJECT are terminal. 
> NAT-specific targets such as SNAT and DNAT are terminal too. LOG is 
> obviously not terminal. Most if not all mangle-specific targets such as 
> DSCP are not terminal. Indeed one may want to alter several parts of a 
> packet in the same chain.

Hence you could jump to a user defined chain like (create the chain
first):

iptables -t mangle -N AF31
iptables -t mangle -A AF31 -j DSCP --set-dscp-class af31
iptables -t mangle -A AF31 -j ACCEPT

iptables -t mangle -A FORWARD -o net+ -p tcp --dport 25 -j AF31

-- 
Matt Zagrabelny - mzagrabe@d.umn.edu - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]