Re: quota display in iptables -L

["Gáspár Lajos" <swifty@freemail.hu>]

Hi,

31997506400-31997506128=272
You are under the quota!

Maybe you had just bigger packets than 272 bytes...


Swifty



2012-03-09 01:19 keltezéssel, James Anderson írta:
> Hello everyone.
>
> I have been trying to get iptables to stop traffic to the internet
> after I have exceeded 29.8 GB and just allow traffic to the local
> subnet after that. I did the conversion on google and apparently
> 29.8GB is 31997506400 bytes. However tonight when I got home and did
> iptables -L -v, I saw this:
>
> Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
>   pkts bytes target     prot opt in     out     source
> destination
>     28M    32G   ACCEPT     all  --  any    any     anywhere
> !192.168.2.0/24      quota: 31997506400 bytes
> 2459K 3621M  ACCEPT     all  --  any    any     anywhere
> 192.168.2.0/24
>    5770 1151K   REJECT     all  --  any    any     anywhere
> anywhere            reject-with icmp-port-unreachable
>
> At first I thought the quota didn't work, but then I did iptables-save -c
>
> *filter
> :INPUT ACCEPT [23078834:14787771556]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> [28216466:31997506128] -A OUTPUT ! -d 192.168.2.0/24 -m quota --quota
> 31997506400 -j ACCEPT
> [2475569:3622559686] -A OUTPUT -d 192.168.2.0/24 -j ACCEPT
> [24154:2350411] -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
> COMMIT
>
> which shows that it stopped at 29.7999998 GB.
> Could someone perhaps explain the discrepancy?
> Does iptables keep counting bytes even after the quota is full?
>
> many thanks in advance,
>
> James
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html