我在看 hp 的防火墙的实现，没有发现防火墙标记 100 是在哪一步生效的

[VergilGao]

root@xiaoyu-router:~# nft list table inet fw4 | grep "mark set"
                meta l4proto udp meta mark set 0x00000065 tproxy ip to 127.0.0.1:5332 counter packets 47 bytes 15492 accept
                meta l4proto udp meta mark set 0x00000065 counter packets 0 bytes 0 accept
root@xiaoyu-router:~# nft list table inet fw4 | grep "0x00000064"
                meta mark 0x00000064 counter packets 0 bytes 0 return
                meta mark 0x00000064 counter packets 0 bytes 0 return
                meta mark 0x00000064 counter packets 2146 bytes 129810 return
                meta mark 0x00000064 counter packets 989 bytes 63783 return
root@xiaoyu-router:~#

查看防火墙规则时，通过 mark set 过滤只能找到给数据包标记 101 的规则，但是很明显能看到有标记为 100 的数据包，这是怎么做到的？

[muink]

100是核心出站标上的

[VergilGao]

那我现在有一个需求：
大概是这样的，我已经编写了一个路由规则，包括一个新的路由表，还有如下 nft 规则：

table ip iptv {
        chain dstnat {
                type filter hook prerouting priority dstnat - 1; policy accept;
                iifname != { "lo", "limbo", "br-lan" } return
                meta mark 0x00000011 counter packets 0 bytes 0 return
                ip saddr 192.168.17.240/28 meta mark set 0x00000011 counter packets 752 bytes 53584
                ip saddr 192.168.99.101 ip daddr 10.0.0.0/8 meta mark set 0x00000011 counter packets 27 bytes 1540
                ip daddr 10.0.0.0/8 tcp dport 554 meta mark set 0x00000011 counter packets 0 bytes 0
        }

        chain srcnat {
                type nat hook postrouting priority srcnat - 1; policy accept;
                meta mark 0x00000011 log prefix "POSTROUTING: " level info continue
                ct state established counter packets 0 bytes 0 accept
                meta mark 0x00000011 counter packets 84 bytes 5072 continue
                meta mark 0x00000011 oifname "eth1" masquerade
        }
}

我希望所有路由标记为 0x11 的数据包不由 hp 处理，我手动在 hp 的 post.ut 源码里添加了跳过 0x11 的代码，能否将这个改动作为一项 advanced 配置？使用者可以在访问控制里增加一个防火墙标记的控制，在列表里的防火墙标记不由 hp 处理？

[muink]

在路由入口和防火墙入口应该都需要改
你可以先提个pr看看

[VergilGao]

在路由入口和防火墙入口应该都需要改 你可以先提个pr看看

我已经实现了，不过还在测试，这几天测试稳定了的话我再提 PR 看一下
目前状态大概是这样的：

root@xiaoyu-router:~# nft list table inet fw4 | grep -B 4 "meta mark 0x00000011"

        chain homeproxy_redirect_lanac {
                iifname != { "limbo", "br-lan" } counter packets 444 bytes 21342 return
                meta mark 0x00000064 counter packets 0 bytes 0 return
                meta mark 0x00000011 counter packets 304 bytes 18240 return
--
        chain homeproxy_mangle_lanac {
                iifname != { "lo", "limbo", "br-lan" } counter packets 18013 bytes 3520777 return
                iifname != "lo" udp dport 53 counter packets 3257 bytes 236409 return
                meta mark 0x00000064 counter packets 0 bytes 0 return
                meta mark 0x00000011 counter packets 0 bytes 0 return
--
        }

        chain homeproxy_mangle_output {
                meta mark 0x00000064 counter packets 819 bytes 71807 return
                meta mark 0x00000011 counter packets 0 bytes 0 return

[1715173329]

目前不会考虑这类 feature，keep it simple and stupid

[VergilGao]

目前不会考虑这类 feature，keep it simple and stupid

我修改了我自己的规则实现来绕过 hp 的接管：

set iptv_hosts {
    type ipv4_addr
    flags dynamic,timeout
    timeout 30m
}

chain dstnat {
    iifname { "limbo", "br-lan" } meta nfproto ipv4 jump dstnat_iptv
    meta mark 0x11 return
}

chain dstnat_iptv {
    ip saddr 192.168.17.240/28 meta mark set 0x11 counter return
    ip saddr 192.168.99.101 ip daddr 10.0.0.0/8 meta mark set 0x11 counter return
    ip daddr 10.0.0.0/8 tcp dport 554 add @iptv_hosts { ip daddr }
    ip daddr @iptv_hosts meta mark set 0x11 counter return
}

效果：

chain dstnat {
        type nat hook prerouting priority dstnat; policy accept;
        iifname { "limbo", "br-lan" } jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
        iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
        iifname { "limbo", "br-lan" } meta nfproto ipv4 jump dstnat_iptv
        meta mark 0x00000011 return
        meta nfproto ipv4 meta l4proto tcp jump homeproxy_redirect_lanac
}