Re: order of netfilter hooks and check for martian source

Michael Tokarev <[email protected]> Sat, 21 Jun 2025 17:56:02 +0300
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
On 21.06.2025 17:42, Jozsef Kadlecsik wrote:
..
> However, routing decisions can be affected by marking packets. So I'd mark
> packets before routing and use routing tables according to the mark value.

The prob with replies to DNAted packets is that these packets traverse
routing rules first, BEFORE they're seen by netfilter code.  Who can
mark them for routing if routing is done before it's in netfilter?

Thanks,

/mjt