[LARTC] about fw marks on netfilter

[Jose Luis Domingo Lopez]

On Saturday, 26 July 2003, at 11:56:55 +0700,
Rio Martin. wrote:

> Is it okay if i put many different rules on single mark.
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.1.0/24 -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.2.0/24 -j MARK --set-mark 1
> ...
> iptables -t mangle -A PREROUTING -p tcp -s 192.168.10.0/24 -j MARK--set-mark 1
> 
What you show is perfectly legal with iptables/netfilter. MARK target
just associates some number (the mark) to the packets it applies to, and
this mark travels along the (inmodified) packet all its way through the
linux kernel (that it, marks won't propagate trough the network, the
have just local significance).

Don't forget to do "iptables --match mark --mark 1 --jump ACCEPT" or
whatever as soon as possible, because a later "--set-mark 2" would
overwrite the previously set mark.

Regards,

-- 
Jose Luis Domingo Lopez
Linux Registered User #189436     Debian Linux Sid (Linux 2.6.0-test1)