Hello: Ivan Lopez wrote, > iptables -A OUTPUT -t mangle -o $IF_LAN -p tcp --sport 1024: --dport > 1024: -m state --state ESTABLISHED,RELATED -j MARK --set-mark 1 > > passive ftp-data traffic will be marked with this rule, but this is > very generic and may catch other traffic totally unrelated to an ftp > communication... (ie. a dcc send using ip_conntrack_irc) Which is one of the things i want to avoid - marking *all* tracked connections. Now if only one could narrow the marking down purely to FTP traffic. I guess i should make this a feature request to the Netfilter team! ;) -- Emperor Palpatine: Everything that has transpired has done so according to my design.
