You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
1.9 KiB
60 lines
1.9 KiB
Like MARK, i.e. set the fwmark, but the mark is calculated from hashing |
|
packet selector at choice. You have also to specify the mark range and, |
|
optionally, the offset to start from. ICMP error messages are inspected |
|
and used to calculate the hashing. |
|
.PP |
|
Existing options are: |
|
.TP |
|
\fB\-\-hmark\-tuple\fP tuple\fI\fP |
|
Possible tuple members are: |
|
.B src |
|
meaning source address (IPv4, IPv6 address), |
|
.B dst |
|
meaning destination address (IPv4, IPv6 address), |
|
.B sport |
|
meaning source port (TCP, UDP, UDPlite, SCTP, DCCP), |
|
.B dport |
|
meaning destination port (TCP, UDP, UDPlite, SCTP, DCCP), |
|
.B spi |
|
meaning Security Parameter Index (AH, ESP), and |
|
.B ct |
|
meaning the usage of the conntrack tuple instead of the packet selectors. |
|
.TP |
|
\fB\-\-hmark\-mod\fP \fIvalue (must be > 0)\fP |
|
Modulus for hash calculation (to limit the range of possible marks) |
|
.TP |
|
\fB\-\-hmark\-offset\fP \fIvalue\fP |
|
Offset to start marks from. |
|
.TP |
|
For advanced usage, instead of using \-\-hmark\-tuple, you can specify custom |
|
prefixes and masks: |
|
.TP |
|
\fB\-\-hmark\-src\-prefix\fP \fIcidr\fP |
|
The source address mask in CIDR notation. |
|
.TP |
|
\fB\-\-hmark\-dst\-prefix\fP \fIcidr\fP |
|
The destination address mask in CIDR notation. |
|
.TP |
|
\fB\-\-hmark\-sport\-mask\fP \fIvalue\fP |
|
A 16 bit source port mask in hexadecimal. |
|
.TP |
|
\fB\-\-hmark\-dport\-mask\fP \fIvalue\fP |
|
A 16 bit destination port mask in hexadecimal. |
|
.TP |
|
\fB\-\-hmark\-spi\-mask\fP \fIvalue\fP |
|
A 32 bit field with spi mask. |
|
.TP |
|
\fB\-\-hmark\-proto\-mask\fP \fIvalue\fP |
|
An 8 bit field with layer 4 protocol number. |
|
.TP |
|
\fB\-\-hmark\-rnd\fP \fIvalue\fP |
|
A 32 bit random custom value to feed hash calculation. |
|
.PP |
|
\fIExamples:\fP |
|
.PP |
|
iptables \-t mangle \-A PREROUTING \-m conntrack \-\-ctstate NEW |
|
\-j HMARK \-\-hmark-tuple ct,src,dst,proto \-\-hmark-offset 10000 |
|
\-\-hmark\-mod 10 \-\-hmark\-rnd 0xfeedcafe |
|
.PP |
|
iptables \-t mangle \-A PREROUTING -j HMARK \-\-hmark\-offset 10000 |
|
\-\-hmark-tuple src,dst,proto \-\-hmark-mod 10 \-\-hmark\-rnd 0xdeafbeef
|
|
|