All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Taylor, Grant" <gtaylor@riverviewtech.net>
To: lartc@vger.kernel.org
Subject: Re: [SPAM] AW: AW: AW: [LARTC] Activate ingress policies on suse
Date: Wed, 20 Apr 2005 16:53:49 +0000	[thread overview]
Message-ID: <4266891D.3050600@riverviewtech.net> (raw)

Keep in mind that TC only controls traffic that is outbound from a system.  If you are wanting to TC traffic coming in to your system you will need to look at something like IMQ.  IMQ as I understand it is like a virtual device that traffic comes in to and is then resend out of back in to your system as it normally would be with out IMQ in the mix.  The reason that you would want to do this is so that you can assign TC rules to the IMQ to control what does come in on the standard interfaces on your system.

With that in mind your TC rule matching for 8099 coming in will never match b/c you are redirecting it to 8080 before it would be leaving the system where the TC rule is looking for it.  At least that's the way that I understand what you have written. :s



Grant. . . .

Grames Gernot wrote:
>  
> Hi,
> 
> My problem is following now:
> 
> I would like to set the filters for port 8099.
> I have tried it, but nothing happened.
> 
> When I try the same filter for the port 8080 it is working very well.
> 
> .) working filter (here I can see the dropped packages):
> tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8080 
> 0xffff police rate 1kbit burst 1 drop flowid :1
> .) not working filter (here I can`t see the dropped packages):
> tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8099 
> 0xffff police rate 1kbit burst 1 drop flowid :1
> 
> Maybe it is a problem of the port forwarding, because I have set the 
> forwarding of the incoming traffic on 8099 to port 8080.
> 
> iptables -L -t nat
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> DNAT       tcp  --  anywhere             iacapp3.local       tcp 
> dpt:8099 to:192.168.0.10:8080
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> So my goal is to restrict incoming access only to port 8099 an not 8080 
> (where the filters work)!
> 
> Gernot
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

             reply	other threads:[~2005-04-20 16:53 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2005-04-20 16:53 Taylor, Grant [this message]
2005-04-21 20:52 ` [SPAM] AW: AW: AW: [LARTC] Activate ingress policies on suse Andy Furniss

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4266891D.3050600@riverviewtech.net \
    --to=gtaylor@riverviewtech.net \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.