All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Erik S. Johansen" <lists@sperling.no>
To: lartc@vger.kernel.org
Subject: [LARTC] ACCEPT/DROP/REJECT in mangle?
Date: Wed, 10 Mar 2004 15:17:55 +0000	[thread overview]
Message-ID: <200403101717.57378.lists@sperling.no> (raw)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm planning on a redo of a small company setup, using a linux-box on 2.4.2x
kernel as router/natbox/firewall.

We have a rather complex shaping/policing setup, currently using multiple
imq's, htb, sfq and a few thousand lines of scripts. In addition I have
varying classes of rules regarding outbound traffic depending on the internal
origin of the traffic, and a few thousand lines of permit/deny rules.

Now, in order to e.g. permit use of outbound ssh to a specific net, and also
ensure that ssh have a higher priority than e.g. web traffic, I have to
triplicate a rule classifying a stream as ssh; NEW outbound permit, ingress
MARK for htb on an IMQ dev, egress MARK for htb. I'd like to reduce the
number of rules per stream, both for maintenance and performace purposes.

So,

1a) Is it possible/recommended to ACCEPT/DROP/REJECT in mangle FORWARD?
1b) Is it possible/recommended to MARK in filter FORWARD?
2) Can i safely put SFQ on a HTB leaf?
3) It appears that only packets that are not conntracked traverse the nat
table, is this correct?
4) Does mangle OUTPUT happen before or after routing?
5) When exactly in the packet traversal do egress shaping happen? After mangle
POSTROUTING? After nat POSTROUTING?
6) Recommendations on handling the massive number of connections created by
P2P? When P2P classes need to stop borrowing from higher priority classes,
the sheer number of connections appear to create some latency.


Thanks,


- --Erik
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQFATzGjds9m9uhAobARAtfJAKDG2WCKH0YdzFTrZ8/6tuq8pHj4UwCfVdo+
FpUxeg2h1sahuPoNwOMu/go=xSuH
-----END PGP SIGNATURE-----
-----END PGP SIGNATURE-----
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

             reply	other threads:[~2004-03-10 15:17 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-03-10 15:17 Erik S. Johansen [this message]
2004-03-10 18:24 ` [LARTC] ACCEPT/DROP/REJECT in mangle? Patrick Turley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200403101717.57378.lists@sperling.no \
    --to=lists@sperling.no \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.