--====----====----====----====----====----====----====----====----====----===-- Stef> On Monday 27 October 2003 22:26, Dragos Cinteza wrote: >> In the last mail I only put the results of listing chains and classes. Stef> You never told us what's your LAN interface : eth0 or eth1? eth0 is my LAN interface (GREEN): IP = 192.168.1.10 and eth1 is my internet interface (RED) My script blocks access to all stations except the ones that have the right combinations of MAC and IP (7 hosts) Then are in customforward few rules that block access to certain sites. I tryed to do marking based on IP, then based on MAC, but host 192.168.1.1 it still isn't marked. Stef> And you have double filters : for the src and dst. And that's not needed. You can not have packets with src and dst the same address on a nic. I know, i think i should only put source. Im not sure but I think packets still have the LAN (192.168.1.x) source address when are filtered by tc, and only after that the source is replaced with the linux box external ip address for NATing. Anyway the filtering is not done with the source only, as iti isn't with source and destination or only destination. Stef> Stef ================================================================================ _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
