Accordingly this advice from 'traffic_shaping.htm':
Normally, packet marking occurs in the PREROUTING chain before any address
rewriting takes place. This makes it impossible to mark inbound packets
based on their destination address when SNAT or Masquerading are being
used. You can cause packet marking to occur in the FORWARD chain by using
the MARK_IN_FORWARD_CHAIN option in shorewall.conf.
i MUST use 'MARK_IN_FORWARD_CHAIN=Yes' or ':F' suffix in a lot of
rules
in 'tcrules' if i use NAT/SNAT (configured in 'masq' file) and want to use
internal (private) IP-addresses (or networks) in 'tcrules'.
Do i correct understand?
Alex
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
