On Friday 13 January 2012 2:25:45 am Andrew Beverley wrote:
> Thanks for the comprehensive answer Lloyd. A couple of minor
points:
> > 2. You would set up a custom routing table for the special
> > DMZ traffic. Use the info in the above link to do that.
> > Suppose it is called "DMZSPECIAL". You will set up routing
> > to the new DMZ interface using the MYDMZ table, something
> > like this:
> >
> > ip route add 10.x.x.x/8 dev ${DMZinterface} src ${wan} table
> > DMZSPECIAL ip route add default via ${gateway} dev
> > ${interface} table DMZSPECIAL
>
> [...]
>
> > 3. You would NEW mark all packets from the special DMZ hosts
> > with fwmark 1, like this (repeat for each source IP or subnet
> > to use the new interface):
>
> Using marks is one way to do this, and provides plenty of
> flexibility. However, if all the traffic is coming from the
> same IP address / interface, then you should be able to use
> straight iproute2 rules to match those aspects, without even
> touching iptables (see ip rule).
>
> > iptables -t mangle -A PREROUTING -m state --state NEW
> > -s 10.x.x.x -j CONNMARK1
>
> Also, if you do decide to use netfilter marks (which is
> certainly no bad thing IMHO), then you probably don't need to
> mark connections and then restore them. Instead just mark a
> packet straight away:
>
> iptables -t mangle -A PREROUTING -s 10.x.x.x -j MARK --set-mark
> 1
>
> Andy
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe
> netfilter" in the body of a message to
> majordomo@xxxxxxxxxxxxxxx
> More majordomo info at
> http://vger.kernel.org/majordomo-info.html
Thanks to you both. I'll go over your suggestions, and try to
implement this asap. Please stand by as I may need additional
hand-holding :-) .
Dimitri
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
