Hello!
I want to mark all outgoing traffic depending on its service.
Example:
eth0 = 192.168.0.1 (local interface)
ppp0 = 80.10.10.10 (internet 1)
ppp1 = 80.10.10.11 (internet 2)
http traffic over internet 1 (ppp0) ssh traffic to interface 2 (ppp1).
I tried the following (routing and rules are set):
iptables -A PREROUTING -t mangle -s 192.168.0.0/24 -p tcp --dport 80 -j MARK
--set-mark 1 iptables -A PREROUTING -t mangle -s 192.168.0.0/24 -p tcp
--dport 22 -j MARK --set-mark 2
This works fine, but only for standard ports. Now I would like to use
layer7:
iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -m layer7 --l7proto http
-j MARK --set-mark 1 iptables -t mangle -A PREROUTING -s 192.168.0.0/24 -m
layer7 --l7proto ftp -j MARK --set-mark 2
Do not work. An iptables -t mange -L -n -v does not show traffic on the MARK
rules.
But if I do this without the source rule:
iptables -t mangle -A PREROUTING -m layer7 --l7proto http -j MARK --set-mark
1
The traffic is marked. Sure, I can not open a website because the incoming
traffic is also marked and will go out to ppp0, but the layer7 works.
Now my question:
If I would like to use layer7, is there a way to use a source rule too?
Is there an other way to mark with layer7 only the http traffic with source
net 192.168.0.0/24?
Kernel 2.4.27 patched with kernel-2.4-layer7-0.9.1.patch iptables 1.2.11
patched with iptables-layer7-0.9.1.patch
Thanks,
Marco
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
