Dennison Williams wrote:
iptables -t mangle -A PREROUTING -i eth1 -p udp --dport 4500 -j MARK
--set-mark 1
iptables -t filter -A INPUT -m mark --mark 1 -j LOG --log-prefix ipsec_nat_t
iptables -t filter -A INPUT -m mark --mark 1 -j ACCEPT
iptables -t filter -A INPUT -j LOG
iptables -t filter -A INPUT -j REJECT
In general make sure that you are saving the marks to the conntrack
tables and restoring them with
-j CONNTRACK --save-mark
and
-j CONNTRACK --restore-mark
although in your sample this doesn't matter as you tag every incoming
packet and as the other post notes, you seem to accept the connections
before your logging.
I usually only set the mark when the state is NEW
John
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
