Re: mark feature not working as expected

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Victor,
I'm really sorry. Yes. I was using 'mangle' table. Sorry for the inconvenience.


Thanks
Sudheer



Victor Julien wrote:

Hi Sudheer,

As far as i know you can only use --set-mark in the mangle table. You are
trying to use it in the nat table.

Try:
iptables -t mangle -A PREROUTING -i eth0 -o eth2 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -i eth1 -o eth0 -j MARK --set-mark 1

Regards,
Victor

On Thursday 28 October 2004 13:07, Sudheer Divakaran wrote:

Hi,
I'm facing a problem with MARK target.

My Linux box has 3 network cards

eth0 - LAN1
eth2 - LAN2
eth3 - ISP

My problem is that my Lan machines are not able to communicate with each
other (i.e. LAN1 <-> LAN2). Firewall blocks them. But my lan clients
have no problem in accessing internet!!.

Here is my configuration.


# eth0 - LAN1 # eth2 - LAN2 # eth3 - ISP

iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -t mangle -A PREROUTING -i eth0 -o eth2 -j MARK --set-mark 1
#THIS IS NOT WORKING
iptables -t mangle -A PREROUTING -i eth1 -o eth0 -j MARK --set-mark 1
#THIS IS NOT WORKING

#Other rules follows... Not listed here

iptables -A FORWARD -m mark --mark 1 -j ACCEPT #THIS IS NOT WORKING

#Other rules follows... Not listed here


I know that I can do it directly from the FORWARD chain of filter table, but I'm using SQUID for transparent proxying for some machines (Those rules are not listed here), so I want to mark some packets. Could someone please help me on this?


Thanks Sudheer





[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux