LARTC - Jul 2003 - about fw marks on netfilter

Dear all,
Is it okay if i put many different rules on single mark.
example:

iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp -s 192.168.2.0/24 -j MARK --set-mark 1
...
iptables -t mangle -A PREROUTING -p tcp -s 192.168.10.0/24 -j MARK--set-mark 1

Regards,
Rio Martin.
-- 
Q:  How many mathematicians does it take to screw in a lightbulb?
A:  One.  He gives it to six Californians, thereby reducing the problem
    to the earlier joke.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

On Saturday, 26 July 2003, at 11:56:55 +0700,
Rio Martin. wrote:
> Is it okay if i put many different rules on single mark.
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.0/24 -j MARK
--set-mark 1
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.2.0/24 -j MARK
--set-mark 1
> ...
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.10.0/24 -j
MARK--set-mark 1
> 
What you show is perfectly legal with iptables/netfilter. MARK target
just associates some number (the mark) to the packets it applies to, and
this mark travels along the (inmodified) packet all its way through the
linux kernel (that it, marks won''t propagate trough the network, the
have just local significance).

Don''t forget to do "iptables --match mark --mark 1 --jump
ACCEPT" or
whatever as soon as possible, because a later "--set-mark 2" would
overwrite the previously set mark.

Regards,

-- 
Jose Luis Domingo Lopez
Linux Registered User #189436     Debian Linux Sid (Linux 2.6.0-test1)
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/