MARK match 0xd001 / !0x0/0xff00

[ml70]

In Asus default iptables -t nat and -t mangle are these MARK match 0xd001 entries which never seem to get matched, though? What do they do?

And in -t mangle there's also MARK match !0x0/0xff00 which never seems to get triggered either.

Observed on a RT-AC66U. Creating my own iptables rules and wondering if this is something essential and what's the proper usage. Is this mark arbitrarily chosen or has some function in Asus' hardware?

 

[RMerlin]

In Asus default iptables -t nat and -t mangle are these MARK match 0xd001 entries which never seem to get matched, though? What do they do?

And in -t mangle there's also MARK match !0x0/0xff00 which never seems to get triggered either.

Observed on a RT-AC66U. Creating my own iptables rules and wondering if this is something essential and what's the proper usage. Is this mark arbitrarily chosen or has some function in Asus' hardware?

Traffic marking allows it to bypass CTF.

Mark 0xd001 (which is not in stock firmware) is how I implemented NAT loopback (d001 is loop mirrored). It is matched in the nat table, in the POSTROUTING chain.

The other one is used by Parental Control if I recall correctly.

 

[ml70]

Is it known which tables are bypassed by CTF? Mark 0xd001 is the 'skip CTF' mark?

 

[RMerlin]

Is it known which tables are bypassed by CTF? Mark 0xd001 is the 'skip CTF' mark?

As I said, 0xd001 isn't meant specifically to bypass CTF, it's meant to identify the NAT loopback packets, so they can be NATed.

ANY marked packet will bypass CTF - that's why port forwarded packets will be marked with 0x01 (if I recall).

 

[ml70]

So this is why QoS doesn't work with CTF, as any QOS'd packet has a mark 1-5? This only concerns marks, with TOS (and a matching tc qdisc) it's still possible to have rudimentary QOS while CTF is on? Or does CTF bypass some/all mangle tables so it's not possible to modify TOS?

Trying to set up a working qos system but the speed of the router is rather slow without CTF, that's why the questions. Currently experimenting with Asus' default QOS complimented with a 5 band prio qdisc for TOS priority.

 

[RMerlin]

So this is why QoS doesn't work with CTF, as any QOS'd packet has a mark 1-5? This only concerns marks, with TOS (and a matching tc qdisc) it's still possible to have rudimentary QOS while CTF is on? Or does CTF bypass some/all mangle tables so it's not possible to modify TOS?

Trying to set up a working qos system but the speed of the router is rather slow without CTF, that's why the questions. Currently experimenting with Asus' default QOS complimented with a 5 band prio qdisc for TOS priority.

QoS doesn't work with CTF because CTF improves performance by bypassing certain parts of the Linux kernel (such as Netfilter's FORWARD chain), including those that handle the QoS. Not sure which other specific parts are bypassing, since it's closed source.