Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #3608 > unrolled thread
| Started by | Hongyi Zhao <hongyi.zhao@gmail.com> |
|---|---|
| First post | 2015-11-28 23:55 +0000 |
| Last post | 2015-12-04 09:28 +0100 |
| Articles | 10 — 3 participants |
Back to article view | Back to comp.os.linux.networking
Mark the tor traffic based on port in OUTPUT chain. Hongyi Zhao <hongyi.zhao@gmail.com> - 2015-11-28 23:55 +0000
Re: Mark the tor traffic based on port in OUTPUT chain. Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-11-29 09:22 +0100
Re: Mark the tor traffic based on port in OUTPUT chain. Hongyi Zhao <hongyi.zhao@gmail.com> - 2015-11-29 13:01 +0000
Re: Mark the tor traffic based on port in OUTPUT chain. Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-11-30 00:37 +0100
Re: Mark the tor traffic based on port in OUTPUT chain. Hongyi Zhao <hongyi.zhao@gmail.com> - 2015-11-30 05:15 +0000
Re: Mark the tor traffic based on port in OUTPUT chain. Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-11-30 23:11 +0100
Re: Mark the tor traffic based on port in OUTPUT chain. Jamma Tino Schwarze <jamma-usenet@tisc.de> - 2015-12-01 16:52 +0000
Re: Mark the tor traffic based on port in OUTPUT chain. Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-12-01 20:38 +0100
Re: Mark the tor traffic based on port in OUTPUT chain. Jamma Tino Schwarze <jamma-usenet@tisc.de> - 2015-12-02 12:15 +0000
Re: Mark the tor traffic based on port in OUTPUT chain. Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-12-04 09:28 +0100
| From | Hongyi Zhao <hongyi.zhao@gmail.com> |
|---|---|
| Date | 2015-11-28 23:55 +0000 |
| Subject | Mark the tor traffic based on port in OUTPUT chain. |
| Message-ID | <n3detv$17u$1@aspen.stu.neva.ru> |
Hi all, Currently, I use the ``-m owner --owner-uid $tor-user'' to pick out the tor traffic. But if I want to pick out and mark the traffic based on port in OUTPUT chain of iptables. Is it possible? Regards -- .: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.
[toc] | [next] | [standalone]
| From | Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> |
|---|---|
| Date | 2015-11-29 09:22 +0100 |
| Message-ID | <n3ecjg$26vn$1@saria.nerim.net> |
| In reply to | #3608 |
Hello, Hongyi Zhao a écrit : > > Currently, I use the ``-m owner --owner-uid $tor-user'' to pick out the > tor traffic. But if I want to pick out and mark the traffic based on > port in OUTPUT chain of iptables. Is it possible? Check --dport, --sport or the "multiport" match.
[toc] | [prev] | [next] | [standalone]
| From | Hongyi Zhao <hongyi.zhao@gmail.com> |
|---|---|
| Date | 2015-11-29 13:01 +0000 |
| Message-ID | <n3esvc$g6l$1@aspen.stu.neva.ru> |
| In reply to | #3609 |
On Sun, 29 Nov 2015 09:22:08 +0100, Pascal Hambourg wrote: > Check --dport, --sport or the "multiport" match. I've tried the commands like the following, but all of them doesn't do the trick: sudo iptables -t mangle -A OUTPUT -p tcp --dport 9050 -j MARK --set-mark 0x1 sudo iptables -t mangle -A OUTPUT -p tcp --dport 9040 -j MARK --set-mark 0x1 Regards -- .: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.
[toc] | [prev] | [next] | [standalone]
| From | Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> |
|---|---|
| Date | 2015-11-30 00:37 +0100 |
| Message-ID | <n3g27d$2muu$2@saria.nerim.net> |
| In reply to | #3610 |
Hongyi Zhao a écrit : > On Sun, 29 Nov 2015 09:22:08 +0100, Pascal Hambourg wrote: > >> Check --dport, --sport or the "multiport" match. > > I've tried the commands like the following, but all of them doesn't do > the trick: > > iptables -t mangle -A OUTPUT -p tcp --dport 9050 -j MARK --set-mark 0x1 > iptables -t mangle -A OUTPUT -p tcp --dport 9040 -j MARK --set-mark 0x1 What trick ? They mark matching packets as instructed.
[toc] | [prev] | [next] | [standalone]
| From | Hongyi Zhao <hongyi.zhao@gmail.com> |
|---|---|
| Date | 2015-11-30 05:15 +0000 |
| Message-ID | <n3gm0n$3rn$1@aspen.stu.neva.ru> |
| In reply to | #3611 |
On Mon, 30 Nov 2015 00:37:17 +0100, Pascal Hambourg wrote: >> iptables -t mangle -A OUTPUT -p tcp --dport 9050 -j MARK --set-mark 0x1 >> iptables -t mangle -A OUTPUT -p tcp --dport 9040 -j MARK --set-mark 0x1 > > What trick ? They mark matching packets as instructed. I then want to these packages be routed using the vpn's tun interface. But, in fact, it doesn't work. Regards -- .: Hongyi Zhao [ hongyi.zhao AT gmail.com ] Free as in Freedom :.
[toc] | [prev] | [next] | [standalone]
| From | Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> |
|---|---|
| Date | 2015-11-30 23:11 +0100 |
| Message-ID | <n3ihi3$dgg$1@saria.nerim.net> |
| In reply to | #3612 |
Hongyi Zhao a écrit : > On Mon, 30 Nov 2015 00:37:17 +0100, Pascal Hambourg wrote: > >>> iptables -t mangle -A OUTPUT -p tcp --dport 9050 -j MARK --set-mark 0x1 >>> iptables -t mangle -A OUTPUT -p tcp --dport 9040 -j MARK --set-mark 0x1 >> What trick ? They mark matching packets as instructed. > > I then want to these packages be routed using the vpn's tun interface. That does not depend on iptables alone. > But, in fact, it doesn't work. This statement does not content any useful information.
[toc] | [prev] | [next] | [standalone]
| From | Jamma Tino Schwarze <jamma-usenet@tisc.de> |
|---|---|
| Date | 2015-12-01 16:52 +0000 |
| Message-ID | <n3kj96$8rj$1@easy5.in-chemnitz.de> |
| In reply to | #3612 |
Hongyi Zhao <hongyi.zhao@gmail.com> wrote: >>> iptables -t mangle -A OUTPUT -p tcp --dport 9050 -j MARK --set-mark 0x1 >>> iptables -t mangle -A OUTPUT -p tcp --dport 9040 -j MARK --set-mark 0x1 >> >> What trick ? They mark matching packets as instructed. > > I then want to these packages be routed using the vpn's tun interface. > But, in fact, it doesn't work. Isn't it too late in OUTPUT chain? If I remember correctly, the packets have been routed already. Looking at this chart: http://www.faqs.org/docs/iptables/images/tables_traverse.jpg (referenced from this tutorial http://www.faqs.org/docs/iptables/traversingoftables.html) there's no way to influence routing for local packets. But there might be other ways to achieve what you want to achieve... HTH, Jamma. -- "What we nourish flourishes." - "Was wir nähren erblüht." www.tisc.de
[toc] | [prev] | [next] | [standalone]
| From | Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> |
|---|---|
| Date | 2015-12-01 20:38 +0100 |
| Message-ID | <n3kt0b$148v$1@saria.nerim.net> |
| In reply to | #3614 |
Jamma Tino Schwarze a écrit : > > Isn't it too late in OUTPUT chain? If I remember correctly, the packets > have been routed already. There is a rerouting decision after the OUTPUT chains, to take changes made in these chains into account. > Looking at this chart: > http://www.faqs.org/docs/iptables/images/tables_traverse.jpg This is a bit old. Check the packet flow diagram in the Wikipedia page about iptables or netfilter.
[toc] | [prev] | [next] | [standalone]
| From | Jamma Tino Schwarze <jamma-usenet@tisc.de> |
|---|---|
| Date | 2015-12-02 12:15 +0000 |
| Message-ID | <n3mnce$93d$1@easy5.in-chemnitz.de> |
| In reply to | #3615 |
Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote: >> Isn't it too late in OUTPUT chain? If I remember correctly, the packets >> have been routed already. > > There is a rerouting decision after the OUTPUT chains, to take changes > made in these chains into account. Ok, that was news to me. >> Looking at this chart: >> http://www.faqs.org/docs/iptables/images/tables_traverse.jpg > > This is a bit old. Check the packet flow diagram in the Wikipedia page > about iptables or netfilter. Thanks for the pointer, although I couldn't spot a rerouting decision there... Bye, Jamma. -- "What we nourish flourishes." - "Was wir nähren erblüht." www.tisc.de
[toc] | [prev] | [next] | [standalone]
| From | Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> |
|---|---|
| Date | 2015-12-04 09:28 +0100 |
| Message-ID | <n3rirq$27f$1@saria.nerim.net> |
| In reply to | #3616 |
Jamma Tino Schwarze a écrit : > Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> wrote: > >>> Isn't it too late in OUTPUT chain? If I remember correctly, the packets >>> have been routed already. >> There is a rerouting decision after the OUTPUT chains, to take changes >> made in these chains into account. > > Ok, that was news to me. > >>> Looking at this chart: >>> http://www.faqs.org/docs/iptables/images/tables_traverse.jpg >> This is a bit old. Check the packet flow diagram in the Wikipedia page >> about iptables or netfilter. > > Thanks for the pointer, although I couldn't spot a rerouting decision > there... "Reroute check" after mangle/output.
[toc] | [prev] | [standalone]
Back to top | Article view | comp.os.linux.networking
csiph-web