On May 5, 2005, at 9:11 AM, Jonathan Camenisch wrote:
Or maybe what I'm missing is some advantage in matching multiple rules. (?) If a packet matches one rule, which tells it to be tagged or logged, will the tagging or logging still be applied to the packet if it ends up matching another rule?
That could be pretty helpful.
You obviously read the man page since you know what tagging is. Now finish reading...
tag <string>
Packets matching this rule will be tagged with the specified
string. The tag acts as an internal marker that can be used to
identify these packets later on. This can be used, for example, to
provide trust between interfaces and to determine if packets have
been processed by translation rules. Tags are "sticky", meaning
that the packet will be tagged even if the rule is not the last
matching rule. Further matching rules can replace the tag with a
new one but will not remove a previously applied tag. A packet is
only ever assigned one tag at a time. pass rules that use the tag
keyword must also use keep state, modulate state or synproxy state.
Packet tagging can be done during nat, rdr, or binat rules in addi-
tion to filter rules. Tags take the same macros as labels (see
above).
-- Jason Dixon DixonGroup Consulting http://www.dixongroup.net
