Hi, I'm having trouve using mangling on NATed packets: Here's what we're trying to do: We're trying to build a system to test the behaviour of our web applications with slow links. For that, we decided to use the Linux QoS, and SNAT+DNAT to redirect the packets from the linux system to the webserver. The idea behind this is that someone contacting the linux on the 8081 port will be transparently redirected to the 8080 of the real web server, simulating a 56k modem. on the 8082 port, it could be a 128 link, etc ... The system is a Redhat 7.3 To create this, I used: - DNAT and SNAT rules to redirect the packets from my port to the web server, and SNAT the packet (so that it is returned to me and i can shape it too) [these are OK] - a QoS script (simple, using fwmarks) [ok too] - And I wanted to mangle the packets to put the marks on the NATed pakets [here comes the trouble] I'll continue on the above example : # For the NAT iptables -t nat -A PREROUTING -p tcp --destination-port 8081:8090 -j DNAT --to-destination 89.131.0.7:8080 iptables -t nat -A POSTROUTING -p tcp --destination 89.131.0.7 -j SNAT --to-source 89.131.0.58 # For the marks iptables -A PREROUTING -t mangle -p tcp --destination-port 8081 -j MARK --set-mark 10 iptables -A POSTROUTING -t mangle -p tcp --source-port 8081 -j MARK --set-mark 11 # Trying to match the return NATed packet The --set-mark 10 works (no surprise, very simple rule in fact) the --set-mark 11 doesn't match. It may be normal, as I'm trying to match a return packet on a NAT connexion. How am I supposed to match the return packet in such a situation ? Thanks fof helping
