Hi Eric >@2004.11.03_21:07:48_+0200
> > If I add
> >
> > # rules to track ftp
> > iptables -t mangle -A POSTROUTING -p tcp -j CONNMARK --restore-mark
> > iptables -t mangle -A POSTROUTING -p tcp -m mark ! --mark 0 -j RETURN
>
> If packet are marked they return so leave mangle, so if CONNMARK works
> leave mangle.
>
> > # a rule to see how much ftp traffic is matched
> > iptables -t mangle -A POSTROUTING -m mark --mark 2
>
> This line is never reached if CONNMARK works.
Ok, sorry I didn't paste the real commands. It is actually:
# rules to send all traffic to user-defined chain
iptables -t mangle -N TRACK
iptables -t mangle -A POSTROUTING -j TRACK
# a rule to see how much ftp traffic is matched
iptables -t mangle -A POSTROUTING -m mark --mark 2
# rules to track ftp
iptables -t mangle -A TRACK -p tcp -j CONNMARK --restore-mark
iptables -t mangle -A TRACK -p tcp -m mark ! --mark 0 -j RETURN
iptables -t mangle -A TRACK -p tcp --dport 21 -j MARK --set-mark 2
iptables -t mangle -A TRACK -j CONNMARK --save-mark
In other words, it returns from a user-defined chain and the mark is in the
top level chain and will always be matched.
With above, it doesn't match all the ftp traffic. It definitely matches
some, but I think it is just the port 21 traffic, not the port 20 (ftp-data)
stuff which should be picked up by the connection tracking.
I also tried a derivative of above scheme which doesn't work properly either:
iptables -t mangle -A POSTROUTING -p tcp --dport 21 \
-m state --state NEW,ESTABLISHED,RELATED -j MARK --set-mark 2
iptables -t mangle -A POSTROUTING -m mark --mark 2
Above rule have pretty much the same effect.
--
Regards
Abraham
TODAY the Pond!
TOMORROW the World!
-- Frogs (1972)
___________________________________________________
Abraham vd Merwe - Frogfoot Networks CC
1st Floor, Albion Springs, 183 Main Road, Newlands
Phone: +27 21 689 3876 Cell: +27 82 565 4451
Http: http://www.frogfoot.net/ Email: abz@xxxxxxxxxxxx
