>>so it's seem possible to use it in forward.
Maybe somethink this can help :
-A vmbr1-OUT -m physdev --physdev-in tap123i0 --physdev-is-bridged -j
tap123i0-OUT
-A tap123i0-OUT -j GROUP-security1-OUT
-A GROUP-security1-OUT -p icmp -J MARK --set-mark 1
-A tap123i0-OUT -m mark --mark 0x1 -j vmbr1-IN
?
----- Mail original -----
De: "Alexandre DERUMIER" <[email protected]>
À: "Dietmar Maurer" <[email protected]>
Cc: [email protected]
Envoyé: Mardi 18 Février 2014 18:30:00
Objet: Re: [pve-devel] pvefw security group question
just found this
http://andys.org.uk/bits/2010/01/27/iptables-fun-with-mark/
so it's seem possible to use it in forward.
----- Mail original -----
De: "Alexandre DERUMIER" <[email protected]>
À: "Dietmar Maurer" <[email protected]>
Cc: [email protected]
Envoyé: Mardi 18 Février 2014 18:26:45
Objet: Re: [pve-devel] pvefw security group question
>>That would be very strange, because it only set an integer value in the
>>packet.
>>I think that is available in all tables?
Maybe I'm wrong, should be tested :)
----- Mail original -----
De: "Dietmar Maurer" <[email protected]>
À: "Alexandre DERUMIER" <[email protected]>
Cc: [email protected]
Envoyé: Mardi 18 Février 2014 18:06:21
Objet: RE: pvefw security group question
> >>to mark packets which should be ACCEPTED? Does that help?
>
> AFAIK, MARK can only be used in mangle table, not in filter table
That would be very strange, because it only set an integer value in the packet.
I think that is available in all tables?
_______________________________________________
pve-devel mailing list
[email protected]
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
_______________________________________________
pve-devel mailing list
[email protected]
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
_______________________________________________
pve-devel mailing list
[email protected]
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
