Jörg Harmuth wrote:
Antonio Pérez schrieb:
Hi Joerg,
Thanks for your reply, I also tried PREROUTING and also many different
protocols, not only http and the problem remains the same, everything
seems to work properly, no errors, but the number of marked packets
remains empty.
Any idea will be apreciated, thanks.
Could you please post the output of iptables-save ? I assume, that some
other rules are the culprit ;)
Have a nice time,
Joerg
iptables-save
# Generated by iptables-save v1.3.3 on Wed Aug 24 14:05:01 2005
*mangle
:PREROUTING ACCEPT [633:402628]
:INPUT ACCEPT [633:402628]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [606:91422]
:POSTROUTING ACCEPT [606:91422]
-A PREROUTING -m layer7 --l7proto http -j MARK --set-mark 0x1
-A PREROUTING -m layer7 --l7proto dns -j MARK --set-mark 0x1
-A POSTROUTING -m layer7 --l7proto http -j MARK --set-mark 0x1
-A POSTROUTING -m layer7 --l7proto dns -j MARK --set-mark 0x1
COMMIT
# Completed on Wed Aug 24 14:05:01 2005
iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 637 packets, 403K bytes)
pkts bytes target prot opt in out source
destination
0 0 MARK all -- any any anywhere
anywhere LAYER7 l7proto http MARK set 0x1
0 0 MARK all -- any any anywhere
anywhere LAYER7 l7proto dns MARK set 0x1
Chain INPUT (policy ACCEPT 637 packets, 403K bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 610 packets, 91630 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 610 packets, 91630 bytes)
pkts bytes target prot opt in out source
destination
0 0 MARK all -- any any anywhere
anywhere LAYER7 l7proto http MARK set 0x1
0 0 MARK all -- any any anywhere
anywhere LAYER7 l7proto dns MARK set 0x1
I applied layer7 patch to kernel and iptables, do I need to add any
other path?
Thanks again.
