I use iptables DNAT which rerouts outgoin packets from my system to 127.0.0.1:121. On that port I have redsocks program that converts this into socks traffic and then I route this traffic through outside servers over the internet. simplyfying greatly: iptables -t mangle -A OUTPUT -j MARK --set-mark 1 (some conditions were here originaly) iptables -t mangle -A OUTPUT -p tcp --dport 21 -j MARK --set-mark 0 #exception for ftp # does not work ok iptables -t mangle -A OUTPUT -p tcp --dport 22 -j MARK --set-mark 0 #exception for sftp,ssh iptables -t nat -A OUTPUT -p tcp -m mark --mark 1 -j DNAT --to 127.0.0.1:121 I don't want to DNAT outgoing sftp and ftp connections. Exceptions work well with sftp but FTP of course not because it uses another data chanell - in passive mode another outgoing connection from high port to high port. I don't think conntrack can track ougoint FTP protocol connections. Is there any solution for me -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
