|
Packit |
7b22a4 |
Like MARK, i.e. set the fwmark, but the mark is calculated from hashing
|
|
Packit |
7b22a4 |
packet selector at choice. You have also to specify the mark range and,
|
|
Packit |
7b22a4 |
optionally, the offset to start from. ICMP error messages are inspected
|
|
Packit |
7b22a4 |
and used to calculate the hashing.
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
Existing options are:
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-tuple\fP tuple\fI\fP
|
|
Packit |
7b22a4 |
Possible tuple members are:
|
|
Packit |
7b22a4 |
.B src
|
|
Packit |
7b22a4 |
meaning source address (IPv4, IPv6 address),
|
|
Packit |
7b22a4 |
.B dst
|
|
Packit |
7b22a4 |
meaning destination address (IPv4, IPv6 address),
|
|
Packit |
7b22a4 |
.B sport
|
|
Packit |
7b22a4 |
meaning source port (TCP, UDP, UDPlite, SCTP, DCCP),
|
|
Packit |
7b22a4 |
.B dport
|
|
Packit |
7b22a4 |
meaning destination port (TCP, UDP, UDPlite, SCTP, DCCP),
|
|
Packit |
7b22a4 |
.B spi
|
|
Packit |
7b22a4 |
meaning Security Parameter Index (AH, ESP), and
|
|
Packit |
7b22a4 |
.B ct
|
|
Packit |
7b22a4 |
meaning the usage of the conntrack tuple instead of the packet selectors.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-mod\fP \fIvalue (must be > 0)\fP
|
|
Packit |
7b22a4 |
Modulus for hash calculation (to limit the range of possible marks)
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-offset\fP \fIvalue\fP
|
|
Packit |
7b22a4 |
Offset to start marks from.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
For advanced usage, instead of using \-\-hmark\-tuple, you can specify custom
|
|
Packit |
7b22a4 |
prefixes and masks:
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-src\-prefix\fP \fIcidr\fP
|
|
Packit |
7b22a4 |
The source address mask in CIDR notation.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-dst\-prefix\fP \fIcidr\fP
|
|
Packit |
7b22a4 |
The destination address mask in CIDR notation.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-sport\-mask\fP \fIvalue\fP
|
|
Packit |
7b22a4 |
A 16 bit source port mask in hexadecimal.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-dport\-mask\fP \fIvalue\fP
|
|
Packit |
7b22a4 |
A 16 bit destination port mask in hexadecimal.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-spi\-mask\fP \fIvalue\fP
|
|
Packit |
7b22a4 |
A 32 bit field with spi mask.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-proto\-mask\fP \fIvalue\fP
|
|
Packit |
7b22a4 |
An 8 bit field with layer 4 protocol number.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-hmark\-rnd\fP \fIvalue\fP
|
|
Packit |
7b22a4 |
A 32 bit random custom value to feed hash calculation.
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
\fIExamples:\fP
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
iptables \-t mangle \-A PREROUTING \-m conntrack \-\-ctstate NEW
|
|
Packit |
7b22a4 |
\-j HMARK \-\-hmark-tuple ct,src,dst,proto \-\-hmark-offset 10000
|
|
Packit |
7b22a4 |
\-\-hmark\-mod 10 \-\-hmark\-rnd 0xfeedcafe
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
iptables \-t mangle \-A PREROUTING -j HMARK \-\-hmark\-offset 10000
|
|
Packit |
7b22a4 |
\-\-hmark-tuple src,dst,proto \-\-hmark-mod 10 \-\-hmark\-rnd 0xdeafbeef
|