Differentiating port-forwarding in iptables rules

[Philip Prindeville]

Hi,

I’m still using firewall3 (yeah, yeah, I know).

I remap certain ports, and I TARPIT them on the well-known service port, but that’s also catching the remapped destination port.

For instance, let’s say I run Telnet (I don’t, but we’ll use it as an example) from 2300 to 23.  I want to TARPIT traffic arriving (unmapped) on 23, but traffic remapped from 2300 to 23 I don’t want to TARPIT.

How do I differentiate these in the rules?  I thought the MARK might give a hint but it doesn’t.

Is there another attribute I can use?

Thanks,

-Philip