On Mar 18 2008 00:25, Eric Leblond wrote: >On Monday, 2008 March 17 at 16:13:45 -0400, Sohan Shetty wrote: >> Forwarding query from Paritosh Tyagi to Netfilter mailing list. >> >> Is there a patch to support the in-interface and out-interface or >> mark in the conntrack module? So, we can have two entries in there >> where the 4 tuple is the same only the interface is different? > >There is no such patch. A similar question was asked some time ago and >if I remember well, the conclusion was the setup was too weird from a >firewall point-of-view. >Suggestion was made to use some virtualization solution. I believe that nf_conntrack deliberately does not use interfaces as tuple parts because packets may very well come in on and/or leave on different interfaces (routing on fwmark). -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
