* Re: Ingress qdisc via fwmark
2013-11-12 14:29 Ingress qdisc via fwmark Chris Elston
@ 2013-11-12 17:23 ` Chris Elston
2013-11-12 18:31 ` Andrew Beverley
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Chris Elston @ 2013-11-12 17:23 UTC (permalink / raw)
To: lartc
Hi Remy,
Thanks for the suggestion. I think I've implemented it as per your
recommendation:
# iptables -L PREROUTING -t mangle -v
Chain PREROUTING (policy ACCEPT 455K packets, 33M bytes)
pkts bytes target prot opt in out source destination
227K 21M MARK all -- any any lns anywhere l2tp tid 54356 sid 62245 type data MARK set 0x1
227K 21M CONNMARK all -- any any lns anywhere mark match 0x1 CONNMARK save
But nothing's hitting the tc filter:
# tc -s filter show dev eth1 parent ffff:
filter protocol ip pref 1 fw
filter protocol ip pref 1 fw handle 0x1 classid :1 police 0x7 rate 32768bit burst 10Kb mtu 2Kb action drop overhead 0b
ref 1 bind 1
Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
# tc -s qdisc show dev eth1
<snip>
qdisc ingress ffff: parent ffff:fff1 ----------------
Sent 21410620 bytes 236564 pkt (dropped 0, overlimits 0 requeues 0)
backlog 0b 0p requeues 0
Anything jump out at you as obviously incorrect?
Thanks,
Chris.
On Tue, 2013-11-12 at 16:37 +0100, Remy Mudingay wrote:
> Opps I forgot to iclude the link.
>
>
> https://hydra.geht.net/tino/howto/linux/net/netfilter/
>
>
>
> On 12 November 2013 16:35, Remy Mudingay <remy.mudingay@gmail.com>
> wrote:
> Hi Chris,
>
>
>
>
> What you are trying to achieve can only work on the PREROUTING
> table. Take a look at the following diagram to get a clearer
> picture of how a packet flows through Linux (Netfilter/Qos).
>
>
> The PREROUTING table is the only netfilter table which is
> processed before the ingress qdisc.
> You also need to apply the connmark target as in " -j CONNMARK
> --save-mark" following you iptables command as follows ;
>
>
> Example:
>
>
> iptables -A PREROUTING -t mangle -s 192.168.101.20 -m l2tp
> --tidR380 --sid4787 --typeÚta -j MARK --set-mark 1
>
> iptables -A PREROUTING -t mangle -s 192.168.101.20 -m mark
> --mark 1 -j CONNMARK --save-mark
>
>
>
> I hope that helps.
>
>
> Remy
>
>
>
>
>
>
> On 12 November 2013 15:29, Chris Elston <celston@katalix.com>
> wrote:
> Hello,
>
> I'm having a little trouble getting ingress policing
> working, filtering
> based on an iptables fwmark. The iptables fwmark is
> being set with a new
> L2TP packet classifier:
>
> # iptables -A INPUT -t mangle -s 192.168.101.20 -m
> l2tp --tidR380 --sid4787 --typeÚta -j MARK
> --set-mark 1
>
> (Note that I have also tried adding to the PREROUTING
> mangle table
> too...)
>
> I have confirmed that the classifier is marking
> packets:
>
> # iptables -L INPUT -t mangle -v
> Chain INPUT (policy ACCEPT 59641 packets, 44M bytes)
> pkts bytes target prot opt in out source
> destination
> 172 7912 MARK all -- any any lns
> anywhere l2tp tid 52380 sid
> 34787 type data MARK set 0x1
>
> I have set up an ingress qdisc with:
>
> # tc qdisc add dev eth1 handle ffff: ingress
>
> And a filter to police the marked packets:
>
> # tc filter add dev eth1 protocol ip parent ffff: prio
> 1 handle 1 fw police rate 32768 burst 10k drop
> flowid :1
>
> But none are getting dropped:
>
> # tc -s qdisc show dev eth1
> <snip>
> qdisc ingress ffff: parent ffff:fff1 ----------------
> Sent 15712712 bytes 186225 pkt (dropped 0, overlimits
> 0 requeues 0)
> backlog 0b 0p requeues 0
>
> I believe from the HOWTO:
> (http://www.linuxdocs.org/HOWTOs/Adv-Routing-HOWTO-14.html section 14.2)
> that this should be possible, but I've also found
> mention
> (http://www.spinics.net/lists/lartc/msg18021.html)
> that the new-style
> policer happens before PREROUTING.
>
> Also, this diagram suggests that queueing to the
> ingress qdisc happens
> before classification takes place:
> http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
>
> I'm using kernel 3.2.x, with CONFIG_NET_ACT_POLICE=m.
>
> A previous scheme I had DID manage to drop ingress
> L2TP packets matching
> the specification using the tc u32 filter - but the tc
> commands were
> becoming very complicated and would be difficult to
> manage dynamically,
> hence the switch to an iptables classifier.
>
> I'm hoping that someone on the list can let me know
> whether this is
> actually possible with contemporary kernels, and if
> so, where I'm going
> wrong.
>
> Thanks,
>
> Chris.
>
> --
> To unsubscribe from this list: send the line
> "unsubscribe lartc" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at
> http://vger.kernel.org/majordomo-info.html
>
>
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: Ingress qdisc via fwmark
2013-11-12 14:29 Ingress qdisc via fwmark Chris Elston
2013-11-12 17:23 ` Chris Elston
@ 2013-11-12 18:31 ` Andrew Beverley
2013-11-27 17:31 ` Chris Elston
2013-11-27 17:39 ` Andrew Beverley
3 siblings, 0 replies; 5+ messages in thread
From: Andrew Beverley @ 2013-11-12 18:31 UTC (permalink / raw)
To: lartc
On Tue, 2013-11-12 at 14:29 +0000, Chris Elston wrote:
> Hello,
>
> I'm having a little trouble getting ingress policing working, filtering
> based on an iptables fwmark.
As you allude to, this is not possible with a vanilla kernel (unless
it's changed recently).
> Also, this diagram suggests that queueing to the ingress qdisc happens
> before classification takes place:
> http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
Yes, the ingress qdisc will see the packets before they have hit
netfilter.
> I'm hoping that someone on the list can let me know whether this is
> actually possible with contemporary kernels, and if so, where I'm going
> wrong.
The only options I know of are:
1. Use IMQ (not in the vanilla kernel).
2. If you're forwarding packets, then use an egress qdisc on the output
interface.
3. If you want to DROP packets, then you might be able to do so once the
client sends reply packets, and therefore catch them using egress on
their way back out.
4. Use a U32 filter on ingress. You may find the discussion here useful:
http://www.spinics.net/lists/lartc/msg22354.html
Andy
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Ingress qdisc via fwmark
2013-11-12 14:29 Ingress qdisc via fwmark Chris Elston
2013-11-12 17:23 ` Chris Elston
2013-11-12 18:31 ` Andrew Beverley
@ 2013-11-27 17:31 ` Chris Elston
2013-11-27 17:39 ` Andrew Beverley
3 siblings, 0 replies; 5+ messages in thread
From: Chris Elston @ 2013-11-27 17:31 UTC (permalink / raw)
To: lartc
Hi Andy,
Sorry for the much delayed reply. I just wanted to say thanks for the
summary.
I finally managed to get things working using option 4. I found that
using U32 to do anything but quite simple packet inspection quickly
becomes pretty difficult to manage :(
Cheers,
Chris.
On Tue, 2013-11-12 at 18:31 +0000, Andrew Beverley wrote:
> On Tue, 2013-11-12 at 14:29 +0000, Chris Elston wrote:
> > Hello,
> >
> > I'm having a little trouble getting ingress policing working, filtering
> > based on an iptables fwmark.
>
> As you allude to, this is not possible with a vanilla kernel (unless
> it's changed recently).
>
> > Also, this diagram suggests that queueing to the ingress qdisc happens
> > before classification takes place:
> > http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
>
> Yes, the ingress qdisc will see the packets before they have hit
> netfilter.
>
> > I'm hoping that someone on the list can let me know whether this is
> > actually possible with contemporary kernels, and if so, where I'm going
> > wrong.
>
> The only options I know of are:
>
> 1. Use IMQ (not in the vanilla kernel).
>
> 2. If you're forwarding packets, then use an egress qdisc on the output
> interface.
>
> 3. If you want to DROP packets, then you might be able to do so once the
> client sends reply packets, and therefore catch them using egress on
> their way back out.
>
> 4. Use a U32 filter on ingress. You may find the discussion here useful:
>
> http://www.spinics.net/lists/lartc/msg22354.html
>
> Andy
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe lartc" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Ingress qdisc via fwmark
2013-11-12 14:29 Ingress qdisc via fwmark Chris Elston
` (2 preceding siblings ...)
2013-11-27 17:31 ` Chris Elston
@ 2013-11-27 17:39 ` Andrew Beverley
3 siblings, 0 replies; 5+ messages in thread
From: Andrew Beverley @ 2013-11-27 17:39 UTC (permalink / raw)
To: lartc
On Wed, 2013-11-27 at 17:31 +0000, Chris Elston wrote:
> Hi Andy,
>
> Sorry for the much delayed reply. I just wanted to say thanks for the
> summary.
You're welcome.
> I finally managed to get things working using option 4. I found that
> using U32 to do anything but quite simple packet inspection quickly
> becomes pretty difficult to manage :(
Erm, yes. Well if you ever get a chance to write something up, then I
think the user community would appreciate it. Even if it's just an email
to this list!
Andy
^ permalink raw reply [flat|nested] 5+ messages in thread
