Not much related to this, but is there any way to make CBQ match packets with no firewall mark set (default) when using Firewall mark classifier? Thanks! Forster "Alexander W . Janssen" <yalla@xxxxxxxxxxxx>@lists.samba.org on 11/04/2001 18:34:57 Please respond to "Alexander W . Janssen" <yalla@xxxxxxxxxxxx> Sent by: netfilter-admin@xxxxxxxxxxxxxxx To: Urs Thuermann <urs@xxxxxxxxxxxxxxxxx> cc: Netfilter Mailinglist <netfilter@xxxxxxxxxxxxxxx> Subject: Re: RFC1918 blocking and DNAT Hello Urs, On Sun, Apr 01, 2001 at 11:03:42AM +0200, Urs Thuermann wrote: [...] > iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -d 10.0.0.0/8 -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -d 172.16.0.0/12 -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -d 192.168.0.0/16 -j MARK --set-mark 1 > > iptables -A extin -m mark --mark 1 -j DROP > > Would this work? And is there another way to do it, using only the > filter tables? yes, this would work. Another way to restrict so called "martians" (packets with source-ip equal to private assigend ones which come from the internet) is setting the kernel-option "reverse path filtering" to the value of 2 for your external interface. Example: echo 2 > /proc/sys/net/ipv4/conf/ippp0 if ippp0 is your external interface. Turning on these options drops all packets with obvisiously "bogus" packets, that means: If you have a network 172.16.0.0/12 behind your firewall, then no one with one of these IP's would be allowed to be routed through your Linux-Box. You might want to read the "Advanced Routing HOWTO", especially section 12.1 "Reverse Path Filtering" (http://www.linuxdoc.org/HOWTO/Adv-Routing-HOWTO-12.html). Anyway, but the best would be to block martian on the router. Just add the crap to the DENY-list of the router. Possible at least on Cisco. Call your provider if you can't administrate your router by yourself. > BTW, the man page does not tell what the default value of a packets > netfilter mark is when it is not changed in the mangle table. I > assume this is 0, right? There is no implicit mark, you allways have to give a --set-mark. Cheers, Alex. -- Join the Linuxbierwanderung 2001 ! 25.8.2001 - 1.9.2001 in Bouillon, Belgium Sign on today at http://lbw2001.ynfonatic.de/
