diff options
| author | 谢致邦 (XIE Zhibang) <Yeking@Red54.com> | 2024-09-12 11:59:33 +0000 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-09-26 13:03:01 +0200 |
| commit | aa758763be6ddcc1c500c6e4e8a15d604e8eadba (patch) | |
| tree | 35085711cd304c39aeb855ef6f9d0a283daebe29 /Documentation | |
| parent | 2cadd3b17738a9160597e17b267876d6a10b7be5 (diff) | |
docs: tproxy: ignore non-transparent sockets in iptables
The iptables example was added in commit d2f26037a38a (netfilter: Add
documentation for tproxy, 2008-10-08), but xt_socket 'transparent'
option was added in commit a31e1ffd2231 (netfilter: xt_socket: added new
revision of the 'socket' match supporting flags, 2009-06-09).
Now add the 'transparent' option to the iptables example to ignore
non-transparent sockets, which is also consistent with the nft example.
Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/networking/tproxy.rst | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Documentation/networking/tproxy.rst b/Documentation/networking/tproxy.rst index 00dc3a1a66b4..7f7c1ff6f159 100644 --- a/Documentation/networking/tproxy.rst +++ b/Documentation/networking/tproxy.rst @@ -17,7 +17,7 @@ The idea is that you identify packets with destination address matching a local socket on your box, set the packet mark to a certain value:: # iptables -t mangle -N DIVERT - # iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT + # iptables -t mangle -A PREROUTING -p tcp -m socket --transparent -j DIVERT # iptables -t mangle -A DIVERT -j MARK --set-mark 1 # iptables -t mangle -A DIVERT -j ACCEPT |