# iptables -t mangle -A POSTROUTING -m mark --mark ! 0 -j ACCEPT iptables v1.3.3: Bad MARK value `!'' I''m puzzled, what''s wrong with this syntax? kernel is 2.6.15.7-ubuntu1 Thanks Francesco
On 2/22/07, francesco messineo <francesco.messineo@gmail.com> wrote:> # iptables -t mangle -A POSTROUTING -m mark --mark ! 0 -j ACCEPT > > iptables v1.3.3: Bad MARK value `!'' > > > I''m puzzled, what''s wrong with this syntax? > kernel is 2.6.15.7-ubuntu1also tried with a 2.6.20.1 compiled from source and same result. I can''t make also work these two rules: iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark both fail with: iptables: Invalid argument what''s wrong? Thanks Francesco
On Thu, 2007-02-22 at 14:30 +0100, francesco messineo wrote:> On 2/22/07, francesco messineo <francesco.messineo@gmail.com> wrote: > > # iptables -t mangle -A POSTROUTING -m mark --mark ! 0 -j ACCEPT > > > > iptables v1.3.3: Bad MARK value `!'' > > > > > > I''m puzzled, what''s wrong with this syntax? > > kernel is 2.6.15.7-ubuntu1Not all extensions support all types of matching. Looks like MARK doesn''t support an inverse match. If you want the same effect redirect all traffic to another chain, and within that chain RETURN if you match a 0, and then with a subsequent rule ACCEPT any other packets. This way if packets are MARKed 0 then they will carry on traversing the table, otherwise they will be ACCEPTed iptables -t mangle -A POSTROUTING -J new_chain -- iptables -t mangle -N new_chain iptables -t mangle -A new_chain -m mark --mark 0 -j RETURN iptables -t mangle -A new_chain -j ACCEPT> also tried with a 2.6.20.1 compiled from source and same result. > I can''t make also work these two rules: > > > iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark > > iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark > > both fail with: > > iptables: Invalid argumentLooks like your iptables (or your kernel?) doesn''t support CONNMARK. What version of iptables do you have? Andy Beverley
Hi Andrew, On 2/22/07, Andrew Beverley <andy@andybev.com> wrote:> On Thu, 2007-02-22 at 14:30 +0100, francesco messineo wrote: > > On 2/22/07, francesco messineo <francesco.messineo@gmail.com> wrote: > > > # iptables -t mangle -A POSTROUTING -m mark --mark ! 0 -j ACCEPT > > > > > > iptables v1.3.3: Bad MARK value `!'' > > > > > > > > > I''m puzzled, what''s wrong with this syntax? > > > kernel is 2.6.15.7-ubuntu1 > > Not all extensions support all types of matching. Looks like MARK > doesn''t support an inverse match. > > If you want the same effect redirect all traffic to another chain, and > within that chain RETURN if you match a 0, and then with a subsequent > rule ACCEPT any other packets. This way if packets are MARKed 0 then > they will carry on traversing the table, otherwise they will be ACCEPTed > > iptables -t mangle -A POSTROUTING -J new_chain > > -- > > iptables -t mangle -N new_chain > iptables -t mangle -A new_chain -m mark --mark 0 -j RETURN > iptables -t mangle -A new_chain -j ACCEPT > >ok, that''s easy enough, in fact this isn''t the worst problem...> > also tried with a 2.6.20.1 compiled from source and same result. > > I can''t make also work these two rules: > > > > > > iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark > > > > iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark > > > > both fail with: > > > > iptables: Invalid argument > > Looks like your iptables (or your kernel?) doesn''t support CONNMARK. > What version of iptables do you have?kernel has the CONNMARK support built as module and loaded. iptables is v1.3.3 Thanks Francesco
> > > I can''t make also work these two rules: > > > > > > > > > iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark > > > > > > iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark > > > > > > both fail with: > > > > > > iptables: Invalid argument > > > > Looks like your iptables (or your kernel?) doesn''t support CONNMARK. > > What version of iptables do you have? > > kernel has the CONNMARK support built as module and loaded. > iptables is v1.3.3At a guess 1.3.3 doesn''t support CONNMARK. Try the latest version (1.3.7) - this is the version I''m using and it works fine. Regards, Andy
Hello again On 2/22/07, Andrew Beverley <andy@andybev.com> wrote:> > > > I can''t make also work these two rules: > > > > > > > > > > > > iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark > > > > > > > > iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark > > > > > > > > both fail with: > > > > > > > > iptables: Invalid argument > > > > > > Looks like your iptables (or your kernel?) doesn''t support CONNMARK. > > > What version of iptables do you have? > > > > kernel has the CONNMARK support built as module and loaded. > > iptables is v1.3.3 > > At a guess 1.3.3 doesn''t support CONNMARK. Try the latest version > (1.3.7) - this is the version I''m using and it works fine. >yes indeed, upgrading to 1.3.7 solved the problem. Many thanks Francesco