I have been looking over my mangle rules and saw something that I thought was strange:
Chain PREROUTING (policy ACCEPT 8408K packets, 4376M bytes)
pkts bytes target prot opt in out source destination
6442K 4136M CONNMARK all -- * * 0.0.0.0/0 0.0.0.0/0
CONNMARK match !0x0/0xff CONNMARK restore mask 0xff
417K 60M routemark all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
MARK match 0x0/0xff
105K 17M routemark all -- ppp0 * 0.0.0.0/0 0.0.0.0/0
MARK match 0x0/0xff
96522 15M man1918 all -- ppp0 * 0.0.0.0/0 0.0.0.0/0
state NEW
254K 27M man1918 all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
state NEW
3753K 3098M tcpre all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
182K 33M tcpre all -- ppp0 * 0.0.0.0/0 0.0.0.0/0
8408K 4376M tcpre all -- * * 0.0.0.0/0 0.0.0.0/0
MARK match 0x0/0xff00
I have not really used packet marking outside of shorewall so this might
just be a dumb question, but with "HIGH_ROUTE_MARKS=No" why the 0xff00
mask in that last rule:
8408K 4376M tcpre all -- * * 0.0.0.0/0 0.0.0.0/0
MARK match 0x0/0xff00
ignoring the 0xff from the high order byte, does a match of 0x0/0x00
make any sense? Should that match really be 0x0/0xff?
The origin of that 0xFF00 seems to be in compiler at:
if [ -n "$ROUTEMARK_INTERFACES" -a -z "$TC_EXPERT" ]; then
mark_part="-m mark --mark 0/0xFF00"
at line 958 in 3.4.2.
b.
--
My other computer is your Microsoft Windows server.
Brian J. Murrell
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
