Hy lartc members, I only ACCEPT 7 IP's in FORWARD chain, filtering by IP and MAC. Everything worked fine until i needed to forward ports. The problem is that the nat PREROUTING chain is traversed before the filter FORWARD chain and this way the packets change their source and are not allowed to pass FORWARD that is restricted to only 7 IPs. I use this rules to forward the port: iptables -t nat -A PREROUTING -p tcp --dport <port> -i <external NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern> iptables -t nat -A PREROUTING -p udp --dport <port> -i <external NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern> and this on the FORWARD chain that has a default policy to DROP iptables -A FORWARD -i <internal NIC> -s 192.168.1.1 -m mac --mac-source xx-xx-xx-xx-xx-xx -j ACCEPT Can I identify the marked packets to use them in iptables rules? This would help in this situation because the pakets traverse first the mangle table, get marked, then traverse the nat table where the source ip is changed and in the filter table if would be posible to use the marks i wowld identify the packets even if the source ip is changed. Regards _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
