Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using iptables to to mark the package and want to route based on the marks.

First I added the ip rule:

sudo ip rule add fwmark 1 prohibit

(The "prohibit" is just for test, I will change it to some route table later.)

Then I began to mark the packages:

sudo iptables -A OUTPUT -d 192.168.1.0/24 -j MARK --set-mark 1

But the computer can still access the 192.168.1.0/24 networks.

After a long time's googling and struggling, I tried:

sudo iptables -t mangle -A OUTPUT -d 192.168.1.0/24 -j MARK --set-mark 1

It works and the connection was blocked.

In the first case, the default table of filter is used. So my question is what is the difference between mangle table and filter table? Which one should be used in what cases? As my understanding, all these tables will be consulted before the routing policy, then why the filter table doesn't work properly?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

mangle is for mangling (modifying) packets, while filter is intended to just filter packets.

A consequence of this, is that in LOCAL_OUT, after traversing the tables and getting the filtering decision, mangle may try to redo the routing decision, assuming the filtering decision is not to drop or otherwise take control of the packet, by calling ip_route_me_harder, while filter just returns the filtering decision.

Details at net/ipv4/netfilter/iptable_mangle.c and net/ipv4/netfilter/iptable_filter.c.

share|improve this answer
add comment

Perhaps the MARK target can only be used with the Mangle Table and none else. Check this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.