Vultur Constantin wrote:
Hi,
I have a little problem understanding the way iptables does the
matching of packets.
The problem is like this:
I have an subnet A.B.C.D/X which I mark it with --set-mark 1:
$IPT -A fw-interfaces -i $INT_IF -s $INT_NET -d A.B.C.D/X -m state
--state NEW -j ACCEPT
$IPT -t mangle -A PREROUTING -i $INT_IF -d A.B.C.D/X -j MARK
--set-mark 1
and I mark the connections to port 22 ( ssh ) with --set-mark 2
$IPT -A fw-interfaces -i $INT_IF -s $INT_NET -p tcp --dport 22 -m
state --state NEW -j ACCEPT
$IPT -t mangle -A PREROUTING -i $INT_IF -p tcp --dport 22 -j MARK
--set-mark 2
fw-interfaces is used as a custom chain in FORWARD.
Now my problem is like this:
If I want to connect to ssh to one of the ip's from d A.B.C.D/X all my
packets are set-marked with 2. The rule with d A.B.C.D/X is above
tho one with ssh.
Shouldn't the ssh connection to A.B.C.D/X be marked with 1 ? If not
what I am doing wrong.
It IS marked with 1, subsequently overwritten by 2 by the second rule.
HTH,
M4
