В Птн, 26/01/2007 в 17:12 +0100, Jan Engelhardt пишет: > >В Птн, 26/01/2007 в 12:24 +0100, Jan Engelhardt пишет: > >> >http://www.meteor.dp.ua/casper/firewill.pdf > >> > > >> >how would I make a "feature request" to ask for, say, "mangle2" table > >> >that is just after "nat" in POSTROUTING? The only reason for this move > >> >is the need for ability to catch un-DNAT'ed packets with -j ULOG or > >> >(better) to -j QUEUE. > >> > >> And -t nat -A POSTROUTING -m conntrack ! --ctstate DNAT > >> as a last rule won't do? > > > >This will (probably) catch packets that hasn't been DNAT'ed. > >BUT, the thing I need it to catch replay packets that has already passed > >"un-DNAT" procedure. > > Ah, now I get what you mean with un-DNAT. (Unwrapping I'd say ;-) > Too bad, I don't see a way. But as an intermediate workaround, you could > copy ULOG/QUEUE to a new module, say, MYULOG/MYQUEUE and modify it so as to > display the original address pair (which should easily be possible with kernel > code). That requires kernel hacking practice which I don't have. Also I won't do that, because this is for *production use*, so I would relay on someone experienced. Also, considering that the need I have is not so specific and it is highly probable that it will be usefull for many others I would rather prefer to make a "feature request" for that extra table (ala "mangle2") to be implemented by professional team of kernel developers. And, is it possible to get a verdict about this request here? Or maybe there is more suitable place to ask? Thanks for quick answer. -- Покотиленко Костик <casper@xxxxxxxxxxxx>
