IPtables accounting ...

IPtables accounting ...

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 297 bytes --]

Hi

Where do I do iptables accounting?

For example: If I have users on a private LAN surfing via a proxy on the
firewall and I have web servers in a DMZ also being routed via the
firewall, where do I put my accounting rules? In the FORWARD chain, or
the INPUT chain, or both?

Ray
-- 

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: IPtables accounting ...

[Eric Leblond]

On Wed, 2002-11-13 at 14:24, Raymond Leach wrote:
> Hi
> 
> Where do I do iptables accounting?
> 
> For example: If I have users on a private LAN surfing via a proxy on the
> firewall and I have web servers in a DMZ also being routed via the
> firewall, where do I put my accounting rules? In the FORWARD chain, or
> the INPUT chain, or both?

Not INPUT if you don't have a web server on your firewall.
FORWARD is a good place.

-- 
Éric Leblond
courriel : eleblond@init-sys.com

Re: IPtables accounting ...

[Antony Stone]

On Wednesday 13 November 2002 1:24 pm, Raymond Leach wrote:

> Hi
>
> Where do I do iptables accounting?
>
> For example: If I have users on a private LAN surfing via a proxy on the
> firewall and I have web servers in a DMZ also being routed via the
> firewall, where do I put my accounting rules? In the FORWARD chain, or
> the INPUT chain, or both?

Packets being routed through your firewall go through the FORWARD chain and 
not through the INPUT chain.

Packets going to a proxy application running on your firewall go through the 
INPUT chain and not the FORWARD chain.

Antony.

-- 

Anything that improbable is effectively impossible.

 - Murray Gell-Mann, Nobel Prizewinner in Physics

Re: IPtables accounting ...

[Antony Stone]

On Wednesday 13 November 2002 2:08 pm, Eric Leblond wrote:

> On Wed, 2002-11-13 at 14:24, Raymond Leach wrote:
> > Hi
> >
> > Where do I do iptables accounting?
> >
> > For example: If I have users on a private LAN surfing via a proxy on the
> > firewall and I have web servers in a DMZ also being routed via the
> > firewall, where do I put my accounting rules? In the FORWARD chain, or
> > the INPUT chain, or both?
>
> Not INPUT if you don't have a web server on your firewall.
> FORWARD is a good place.

But he does have a web server on his firewall - he is running a proxy, which 
is both a server and a client in a single application.

Antony.

-- 

Most people have more than the average number of legs.