I am using iptables to to mark the package and want to route based on the marks.
First I added the ip rule:
sudo ip rule add fwmark 1 prohibit
(The "prohibit" is just for test, I will change it to some route table later.)
Then I began to mark the packages:
sudo iptables -A OUTPUT -d 192.168.1.0/24 -j MARK --set-mark 1
But the computer can still access the 192.168.1.0/24 networks.
After a long time's googling and struggling, I tried:
sudo iptables -t mangle -A OUTPUT -d 192.168.1.0/24 -j MARK --set-mark 1
It works and the connection was blocked.
In the first case, the default table of filter is used. So my question is what is the difference between mangle table and filter table? Which one should be used in what cases? As my understanding, all these tables will be consulted before the routing policy, then why the filter table doesn't work properly?