Hi all, I'm trying use CONNMARK to bypass rules for established connections. I'm using only filter table and also not using MARK, since iproute is not used to mark the packet. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :cmchain - [0:0] :inbound - [0:0] :outbound - [0:0] -A INPUT -m connmark ! --mark 0x0 -j ACCEPT -A INPUT -j inbound -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j cmchain -A OUTPUT -m connmark ! --mark 0x0 -j ACCEPT -A OUTPUT -j outbound -A cmchain -j CONNMARK --set-xmark 0x1/0xffffffff -A cmchain -j ACCEPT COMMIT as you can see, inbound chain contains incoming traffic rules, while outbound chain contains outbound traffic rules. i'm trying to bypass inbound rules with checking connection mark for non-zero. This condition is under the assumption that skb->nfct is getting populated in prerouting hook in kernel. Similarly thing i'm doing to bypass outbound rules for established connection. But this implementation is not working since inbound rules are still getting traversed for a established connection. seems like i'm missing some step. Please help me understand where i'm going wrong. TIA -- Warm Regards, Ratnaraj Mirgal http://www.google.co.in/search?q=ratnaraj+mirgal :-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
