Hi Joakim & all, > We (me and Martin) has discussed a table, "border", that is the absolutly > first thing that is being travered after leaving the netcard driver.
I like the idea (a lot!), as well as the placement, but I'm not really fond of the name. May I suggest one of two things? A) Call the table "netdev", with chains "RX" and "TX" B) Call the table "filter", with chains "RX" and "TX" RX/TX could alternatively be RECEIVE/TRANSMIT, if they seem to short. Proposal A) makes it perfectly clear where the mechanism sits. Proposal B) is there just because I have no idea why each such extension needs its own table, when additional predefined chains in the existing filter table seem to also be possible, and the operation to do is filtering. This would break the naive "packet seen in only one chain per table" heuristic, but is that one neccessary? best regards Patrick