Bug 490150 (example, fwmark, in, multiport, Use)

Description of problem:

Example of creating fwmarks for multiport service could benefit from the use of multiport iptables rule


Version-Release number of selected component (if applicable):
Virtual_Server_Administration(EN)-5.2 (2008-05-15T16:07)


In section 3.4.1. Assigning Firewall Marks there is an example of creating firewall marks for use in a multiport service:


==================================================================================
/sbin/iptables -t mangle -A PREROUTING -p tcp -d n.n.n.n/32 --dport 80 -j MARK --set-mark 80

/sbin/iptables -t mangle-A PREROUTING -p tcp -d n.n.n.n/32 --dport 443 -j MARK --set-mark 80 
==================================================================================

The goal of this example is to mark packets with the same firewall mark, but it is being done in multiple commands, which give a greater possibility of error or inconsistency. I recommend making use of the multiport directive so that the same firewall mark is made to all relevant ports at the same time in the same command.  I would change this example to:

/sbin/iptables -t mangle -A PREROUTING -p tcp -d n.n.n.n/32 -m multiport --dports 80,443 -j MARK --set-mark 80

Also .. in the second example in the current documentation, there should be a space between the trailing 'e' in 'mangle' and the '-' used to append this rule to the PREROUTING chain