First mark without the source, then use mark match, like this iptables -t mangle -A PREROUTING -m layer7 --l7proto http -j MARK --set-mark 1 iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -m mark --mark 1 -j MARK --set-mark 2 On Sat, 23 Oct 2004 14:16:38 +0200, Marco Balle <mb@xxxxxxxxxxxxxxxx> wrote: > Hello! > > I want to mark all outgoing traffic depending on its service. > Example: > > eth0 = 192.168.0.1 (local interface) > ppp0 = 80.10.10.10 (internet 1) > ppp1 = 80.10.10.11 (internet 2) > > http traffic over internet 1 (ppp0) ssh traffic to interface 2 (ppp1). > > I tried the following (routing and rules are set): > iptables -A PREROUTING -t mangle -s 192.168.0.0/24 -p tcp --dport 80 -j MARK > --set-mark 1 > iptables -A PREROUTING -t mangle -s 192.168.0.0/24 -p tcp --dport 22 -j MARK > --set-mark 2 > > This works fine, but only for standard ports. Now I would like to use > layer7: > > iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -m layer7 --l7proto http > -j MARK --set-mark 1 > iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -m layer7 --l7proto ftp > -j MARK --set-mark 2 > > Do not work. An iptables -t mange -L -n -v does not show traffic on the MARK > rules. > > But if I do this without the source rule: > > iptables -t mangle -A PREROUTING -m layer7 --l7proto http -j MARK --set-mark > 1 > > The traffic is marked. Sure, I can not open a website because the incoming > traffic is also marked and will go out to ppp0, but the layer7 works. > > Now my question: > > If I would like to use layer7, is there a way to use a source rule too? > Is there an other way to mark with layer7 only the http traffic with source > net 192.168.0.0/24? > > Kernel 2.4.27 patched with kernel-2.4-layer7-0.9.1.patch > iptables 1.2.11 patched with iptables-layer7-0.9.1.patch > > Thanks, > > Marco > > -- Bla bla
