I'm now trying to masquerade packets that have been marked a certain way. I'm using these commands: # I'm not sure this is doing the right thing, but it is not giving errors. iptables -A POSTROUTING -t nat -j MASQUERADE -m mark --mark 10001 # This appears to work as planned. iptables -t mangle -A PREROUTING -i eth1 -j MARK --set-mark 10001 iptables -t mangle -A PREROUTING -i eth2 -j MARK --set-mark 10001 I added a u32 'mark' field to the conn-track tuple, and I now get different conn-tracking objects for the same source/dest but with different 'mark'. However, the ct->status bit does not have the IPS_SRC_NAT flag set. I think I need to figure out what code creates the initial conn-track and make sure it is setting the status bits correctly based on the skb->mark, but I am not sure where this code exists. Any ideas on where to start looking? I've been trying to follow the code path in the netfilter/nat logic, but it's proving slow going! Thanks, Ben PS. If anyone does this sort of work for hire, please contact me off-list. -- Ben Greear <greearb@xxxxxxxxxxxxxxx> Candela Technologies Inc http://www.candelatech.com
