Hi. You wrote: > OK. I've made the diagram in Dia (attached). U can easly export it in any format > (any linux distro have Dia, i think)... Could you post your diagram in ascii? > I made some changes may be they are wrong, pls correct me... I thought that all > "mangle" and "nat" stuff should be "IPTABLES", and all "ipchains" suff should go > away !! ? As I understand there is some ipchains original code running on iptables; but not iptables code to emulate ipchains behavior, just ipchains filter code. Have a look to LARTC digest, Vol 1 #641, #642, #651, #652 and #655. > - What is "mark-rewrite" ?! It would be better "mark-write". It's mark packet writing in mangle table (fwmark). This mark survive just inside host or router that makes the mark (the packet is not really marked when it leaves the router). > - there is something which have to be added somewhere around "forwarding", can't > figure out what/where ?! Pls do it, or tell me i wil do it? > - in my opinion (6a.3) output-routing should go at the place of (7) !!! > 'm I right ? I haven't your diagram. BTW, diagram misses some hooks (must be added): conntrack PREROUTING just before mangle PREROUTING. conntrack INPUT after filter INPUT but before LOCAL PROCESS. mangle INPUT after conntrack INPUT also before LOCAL PROCESS. mangle FORWARD before filter FORWARD. conntrack OUTPUT before mangle OUTPUT but after OUTPUT ROUTING. mangle POSTROUTING before nat POSTROUTING. conntrack POSTROUTING after nat POSTROUTING but before QOS EGRESS. when discussion matures I will post this changes to Stef. Best regards, Leonardo Balliache _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
