Re: [SPAM] AW: AW: AW: [LARTC] Activate ingress policies on suse

* Re: [SPAM] AW: AW: AW: [LARTC] Activate ingress policies on suse
@ 2005-04-20 16:53 Taylor, Grant
  2005-04-21 20:52 ` Andy Furniss
  0 siblings, 1 reply; 2+ messages in thread
From: Taylor, Grant @ 2005-04-20 16:53 UTC (permalink / raw)
  To: lartc

Keep in mind that TC only controls traffic that is outbound from a system.  If you are wanting to TC traffic coming in to your system you will need to look at something like IMQ.  IMQ as I understand it is like a virtual device that traffic comes in to and is then resend out of back in to your system as it normally would be with out IMQ in the mix.  The reason that you would want to do this is so that you can assign TC rules to the IMQ to control what does come in on the standard interfaces on your system.

With that in mind your TC rule matching for 8099 coming in will never match b/c you are redirecting it to 8080 before it would be leaving the system where the TC rule is looking for it.  At least that's the way that I understand what you have written. :s

Grant. . . .

Grames Gernot wrote:
>  
> Hi,
> 
> My problem is following now:
> 
> I would like to set the filters for port 8099.
> I have tried it, but nothing happened.
> 
> When I try the same filter for the port 8080 it is working very well.
> 
> .) working filter (here I can see the dropped packages):
> tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8080 
> 0xffff police rate 1kbit burst 1 drop flowid :1
> .) not working filter (here I can`t see the dropped packages):
> tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8099 
> 0xffff police rate 1kbit burst 1 drop flowid :1
> 
> Maybe it is a problem of the port forwarding, because I have set the 
> forwarding of the incoming traffic on 8099 to port 8080.
> 
> iptables -L -t nat
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> DNAT       tcp  --  anywhere             iacapp3.local       tcp 
> dpt:8099 to:192.168.0.10:8080
> 
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> So my goal is to restrict incoming access only to port 8099 an not 8080 
> (where the filters work)!
> 
> Gernot
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

^ permalink raw reply	[flat|nested] 2+ messages in thread