Philip Prindeville <philipp_subx@xxxxxxxxxxxxxxxxxxxxx> writes: > I've got the following scenario: > > iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 8080 -j DNAT --to-destination :80 > > > but later in the INPUT chain, I'd like to be able to distinguish between > a packet that came in directly to port 80 (which I'd reject) versus a > packet that came in to a different port (like 8080 above) and was > remapped... which I'd like to accept. > > Is there a test to available in INPUT (and FORWARD) see if the packet > had been rewritten in the PREROUTING chain? You could try using the mangle table iptables -t mangle -A PREROUTING -p tcp --dport 8080 -j MARK --set-mark 1 iptables -A INPUT -m mark --mark 1 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j DROP -- To unsubscribe from this list: send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
