Page 1 of 1

Packet Marking and prerouting

Posted: Tue Jan 09, 2007 1:10 pm
by oleg
Hi.
Im trying to create a policy based rules by marking packets and then add them to prerouting rule but although packet do get marked the prerouting rule dosent seem to mark any of them
Example
I mark http packets with dest port 80,8080
Chain Forward >Protocol TCP > Dest Port 80 >
Action > mark packet HTTP
Then i create a prerouting rule
Chain Prerouting > Packet mark HTTP
Action > Mark Routing

When there is http traffic on the wire the HTTP Forward Dose detect it but Prerouting rule not showing anything ( detects no packets )

Is there anything i missing ?

Posted: Tue Jan 09, 2007 1:34 pm
by savagedavid
The prerouting mark happens BEFORE the forward mark, so your rules would not work.

You dont need the forward mark rule to policy route HTTP. You can use something like this:
/ip firewall mangle add chain=prerouting protocol=tcp dst-port=80 action=mark-routing new-routing-mark=http-route comment="Mark HTTP for routing" passthrough=no
Then in /ip routes you can access the http-route routing table and route as required

Posted: Tue Jan 09, 2007 1:40 pm
by oleg
Thanks for reply.
Yes i know that when mark routing used it possible to do that ( i already use this for policy routing ) , i just wanted to mark packets and organize them into one routing rule.
Anyway maybe i should stick to the prerouting rather then packet marking.Thanks for clearing out the problem :)