Jan Engelhardt a écrit :
On Sunday 2008-03-30 13:23, Franck JONCOURT wrote:
What about using the nat table to add your mark on a whole connection
instead of using the mangle table ?
Using the nat table to 'simulate' -m conntrack --ctstate NEW, that's
just a gross hack IMO.
I agree that the use of the nat table for any purpose not related to NAT
should be avoided. However the advantage of the nat table is that it
sees only one packet per connection, while "-m conntrack --ctstate NEW"
or "-m state --state NEW" may match multiple packets per connection,
e.g. duplicate TCP SYN or all UDP sent packets in the original direction
before the first packet sent in the return direction.
If I remove "fwmark 71" in the "ip rule add" command, then it is working,
but has side effects with the following:
# iptables -t nat -A PREROUTING -p TCP -d publicip -j DNAT --to 10.4.0.1
My observations seem to tell me, that ip rule is evaluated BEFORE
iptables rules are applied, so the mark is not set yet.
See http://jengelh.hopto.org/images/nf-packet-flow.png , routing
decision takes place in the middle. (It's called _PRE_ROUTING_ for a
reason.)
My understanding is that the side effects mentioned by the OP apply to
the return packets of DNATed connections, which go through the OUTPUT
chains. The diagram show that a routing decision occurs before the
OUTPUT chains, but a rerouting may occur because of a mark or
destination NAT.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
