At the 1st version of firewall I mark packets in new chain:
1st 2 lines make jump to one of two chains
In every chain I marked connection and then mark packet.
Finally I made masquerade.
(I have created in queue-tree queue for packet mark 10.89.90.100)
Code: Select all
ip firewall mangle add chain=prerouting src-address=10.89.0.0/16 action=jump jump-target=qos_out
ip firewall mangle add chain=prerouting dst-address=10.89.0.0/16 action=jump jump-target=qos_in
ip firewall mangle add chain=qos_out src-address=10.89.90.100 action=mark-connection new-connection-mark=10.89.90.100 passthrough=yes
ip firewall mangle add chain=qos_out connection-mark=10.89.90.100 action=mark-packet new-packet-mark=10.89.90.100 passthrough=no
ip firewall mangle add chain=qos_in dst-address=10.89.90.100 action=mark-connection new-connection-mark=10.89.90.100 passthrough=yes
ip firewall mangle add chain=qos_in connection-mark=10.89.90.100 action=mark-packet new-packet-mark=10.89.90.100 passthrough=no
ip firewall nat add chain=srcnat src-address=10.89.0.0/16 dst-address=!10.89.0.0/16 action=masquerade
Then I experimented and I did very easy thing ... I moved the rules for packet-mark out from the chain "qos_in" and "qos_out" and placed them directly to chain "prerouting".
Code: Select all
ip firewall mangle add chain=prerouting src-address=10.89.0.0/16 action=jump jump-target=qos_out
ip firewall mangle add chain=prerouting dst-address=10.89.0.0/16 action=jump jump-target=qos_in
ip firewall mangle add chain=qos_out src-address=10.89.90.100 action=mark-connection new-connection-mark=10.89.90.100 passthrough=yes
ip firewall mangle add chain=qos_in dst-address=10.89.90.100 action=mark-connection new-connection-mark=10.89.90.100 passthrough=yes
ip firewall mangle add chain=prerouting connection-mark=10.89.90.100 action=mark-packet new-packet-mark=10.89.90.100 passthrough=no
ip firewall nat add chain=srcnat src-address=10.89.0.0/16 dst-address=!10.89.0.0/16 action=masquerade
My question is, WHY???
Why I can not have the mark connection rule placed in new chain, why it must be placed directly in the prerouting chain? Or did I any other mistake?