Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

docs: tproxy: ignore non-transparent sockets in iptables

The iptables example was added in commit d2f26037a38a (netfilter: Add
documentation for tproxy, 2008-10-08), but xt_socket 'transparent'
option was added in commit a31e1ffd2231 (netfilter: xt_socket: added new
revision of the 'socket' match supporting flags, 2009-06-09).

Now add the 'transparent' option to the iptables example to ignore
non-transparent sockets, which is also consistent with the nft example.

Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

authored by

谢致邦 (XIE Zhibang) and committed by
Pablo Neira Ayuso
aa758763 2cadd3b1

+1 -1
+1 -1
Documentation/networking/tproxy.rst
··· 17 17 socket on your box, set the packet mark to a certain value:: 18 18 19 19 # iptables -t mangle -N DIVERT 20 - # iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT 20 + # iptables -t mangle -A PREROUTING -p tcp -m socket --transparent -j DIVERT 21 21 # iptables -t mangle -A DIVERT -j MARK --set-mark 1 22 22 # iptables -t mangle -A DIVERT -j ACCEPT 23 23