All,
This worked fine. Now however we have the requirement for more granular
"stateful" Rules. I though it should be possible to combine
state/conntrack with the QUEUE target ... but this doesn't seem to work.
-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED
-j QUEUE
I think I got it.
-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED
-j QUEUE
-t mangle -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED
-j QUEUE
This combination seems to work. Coming from a Check Point Background I
assumed that the statefulness provided by state/conntrack means that I
only have to specify the initiating connection - replies are
accepted/queued automagically based on connection data.
However I seem to be wrong - or did I completely miss the point?
CU,
Udo
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
