conntrack/state with QUEUE target
All,
I'm a little confused whether the combination of conntrack/state with QUEUE targets is supported.
I have a usermode app which processes packets via libNFQ which works fine. Up to know we had a very simple setup like
-t mangle -A FORWARD -p tcp --dport 80 -j QUEUE
-t mangle -A FORWARD -p tcp --sport 80 -j QUEUE
This worked fine. Now however we have the requirement for more granular "stateful" Rules. I though it should be possible to combine state/conntrack with the QUEUE target ... but this doesn't seem to work.
-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j QUEUE
However using this rule no (http) connection goes through.
Any pointers?
CU,
Udo
All,
Review
Quoted 4 lines
This worked fine. Now however we have the requirement for more granular "stateful" Rules. I though it should be possible to combine state/conntrack with the QUEUE target ... but this doesn't seem to work.
(quoted diff) +0
-2-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j QUEUE
I think I got it.
-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j QUEUE -t mangle -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED -j QUEUE
This combination seems to work. Coming from a Check Point Background I assumed that the statefulness provided by state/conntrack means that I only have to specify the initiating connection - replies are accepted/queued automagically based on connection data.
However I seem to be wrong - or did I completely miss the point?
CU,
Udo