On Wednesday 2008-05-07 16:36, pthyseba@xxxxxxxxxxxxxx wrote: > >This setup works as expected: the targeted packets are routed to the >different gateway. However, my question is: why does this work? Because we expect it to :) >After studying the iptables block diagrams, it seems that the packet >travels through the OUTPUT chains AFTER "routing". I assumed that >"routing" implied the lookup of the correct routing table and then >selection of the correct rule in that table, but putting the iptables and >my definition of "routing" together, it would seem that packets only get >marked (the MARK target is in the output chain) after "routing" has been >done (and I assumed filtering packets using the fwmark filter was done in >that step). Obviously, I'm misunderstanding something, as packets that get >marked in the OUTPUT chain do get routed correctly (meaning, have their >mark set when routing is looking for the correct routing table). Correct, there is an extra reroute done in the output path (see http://jengelh.medozas.de/images/nf-packet-flow.png ) -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
