Masquerade based on skb->mark ?

Pascal Hambourg pascal.mail at
Fri Apr 27 20:23:32 CEST 2007


Ben Greear a écrit :
>>>>> iptables -A POSTROUTING -t nat -j MASQUERADE -m mark --mark 10001
>>>>> iptables -t mangle -A PREROUTING -i eth1  -j MARK --set-mark 10001
>>>>> iptables -t mangle -A PREROUTING -i eth2  -j MARK --set-mark 10001
> If virtual router 1 is routing pkts from to,
> and virtual router 2 is routing pkts from to, and I
> only want to NAT pkts leaving virtual router 1, then I think I
> have to somehow force different ct tuples based on which virtual
> router the pkts are flowing through.  I was trying to do this by
> MARKing packets entering a device in a particular virtual router
> and using the mark as part of the tuple....

 From what you wrote I understand you need a sort of separate connection 
tracking for each "virtual router". But I am afraid it cannot be done 
with MARK, because packet classification by the connection tracking 
takes place before the packet reaches the mangle PREROUTING (or OUTPUT) 

More information about the netfilter mailing list