<span class="e" id="q_108b7103c3a7d4ea_4">#accepts the packet if it has a mark besides the
default 0 and prevents the saved mark from being changed <br>iptables -t
mangle -A PREROUTING -p tcp -m mark ! --mark 0 -j ACCEPT<br><br>That section after the restore-mark rule will cause any saved marks to skip the rest of the chain. This results in only the first packets of a tcp connection having to hit their individual --set-mark rule. If you do have concerns about cpu usage or some such, I'd suggest trying trying out the ipp2p match module instead of the more generic l7match module. It's more specific to p2p and tends to be much faster than doing regular expressions.
<br></span><br><div><span class="gmail_quote">On 1/10/06, <b class="gmail_sendername">Nataniel Klug</b> <<a href="mailto:nata@cnett.com.br">nata@cnett.com.br</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><font face="Arial" size="2">I have a script that makes connections for every
user with his auth. So, in this script, I have two mark tags. Can I use this tip
you give to ro0ot? My doubt is if I use this every time some user log it will be
all executed again, it will not make me trouble?</font></div></blockquote><div><br>I'm not sure exactly what you mean by this. If my above explanation doesn't apply, could you possibly explain or give an example?<br></div>
<br>- Jody<br></div><br>