Re: CONNMARK save-mark and restore-mark not working ?

[Vinod Chandran <vinod_chandran@xxxxxxxxxxxxxxx>]

Hi Ian,


> I think this pair (marking connections with "9"):
>
>    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>    iptables -t mangle -A OUTPUT -j CONNMARK --set-mark 9
>  
>>>>> Here the mark value of the packet as well as the mark value of 
the connection tracking entry are set to 9.

> should be equivalent to this pair:
>
>    iptables -t mangle -A OUTPUT -j MARK --set-mark 9
>    iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
>  
>>>> Here the mark value of the packet is set to 9, which will be saved 
to be used as conntrack mark for all the packets coming after this. But 
this has to be >>>> restored
>>>>Try this combination
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -j MARK --set-mark 9
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

> > > > > Aint sure, hope it works!!!




Regards,
Vinod C