<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000066">
Hello Alejandro,<br>
<br>
The MARK target always returns a CONTINUE verdict internally, so packet
will be matching the next rule as well.<br>
You may append another rule that either RETURNs or ACCEPTs the packet.<br>
<br>
Regards,<br>
Padam<br>
<br>
Alejandro Ramos Encinosa wrote:
<blockquote cite="mid:200704150425.37045.alex@uh.cu" type="cite">
<pre wrap="">Hi all!!
I was trying to figure out how iptables marks work. I thought that a packet
could just be marked once into a chain (if the packet matchs the criteria,
then it the action is applied, and that's all for the packet into this
chain), but I was wrong: I did
iptables -t mangle -A INPUT -i eth0 -j MARK --set-mark 7
iptables -t mangle -A INPUT -i eth0 -j MARK --set-mark 8
and then I did `iptables -t mangle -L -x -v' and I got
Chain INPUT (policy ACCEPT 9565560 packets, 4954706655 bytes)
pkts bytes target prot opt in out source destination
45 31630 MARK 0 -- eth0 any anywhere anywhere MARK set 0x7
45 31630 MARK 0 -- eth0 any anywhere anywhere MARK set 0x8
Can someone tell me how can I be sure one packet will just be marked once into
the chain?
_______________________________________________
LARTC mailing list
<a class="moz-txt-link-abbreviated" href="mailto:LARTC@mailman.ds9a.nl">LARTC@mailman.ds9a.nl</a>
<a class="moz-txt-link-freetext" href="http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc">http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc</a>
</pre>
</blockquote>
</body>
</html>