From: Aaron Clausen <maureen-taocow@alberni.net>
To: lartc@vger.kernel.org
Subject: [LARTC] iptables, IP accounting and traffic shaping
Date: Mon, 07 Oct 2002 22:52:26 +0000 [thread overview]
Message-ID: <marc-lartc-103403120713695@msgid-missing> (raw)
I'm having a big problem with a Linux box I have configured as a NAT router
and for IP accounting. These two functions work without a hitch, but now I
want to do some traffic shaping. I'm using cbq.init, but have the issue
that no packets are hitting the shaping class.
My machine has two ethernet cards, both on the same subnet, but eth1 being
connected to a number of internal NAT networks. I'm using proxy arp to pass
data between the two ethernet cards. I hope the following segment of my
iptables script isn't too big, but it should give a pretty good idea of what
I'm doing.
# beginning of script
/usr/sbin/iptables -F
/usr/sbin/iptables -X
/usr/sbin/iptables -t nat -F
/usr/sbin/iptables -t nat -X
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -P FORWARD ACCEPT
/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT
iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.2 -j DNAT --to 10.102.106.2
iptables -t nat -A POSTROUTING -o eth0 -s 10.102.106.2 -j SNAT --to 64.251.69.2
iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.3 -j DNAT --to 10.101.106.2
iptables -t nat -A POSTROUTING -o eth0 -s 10.101.106.2 -j SNAT --to 64.251.69.3
echo [/etc/rc.d/rc.iptables] Recreating NAT tables...
#iptables -t nat -A POSTROUTING -o eth0 -s 10.101.104.0/21 -d 0/0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -o eth0 -s 10.102.104.0/21 -d 0/0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -o eth0 -s 10.103.104.0/21 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.101.104.0/21 -j SNAT --to 64.251.68.21
iptables -t nat -A POSTROUTING -s 10.102.104.0/21 -j SNAT --to 64.251.68.21
iptables -t nat -A POSTROUTING -s 10.103.104.0/21 -j SNAT --to 64.251.68.21
echo [/etc/rc.d/rc.iptables] Recreating Waverider accounting rules...
/usr/sbin/iptables -N waverid
/usr/sbin/iptables -A FORWARD -j waverid
/usr/sbin/iptables -A waverid -i eth0 -d 64.251.68.19/32
/usr/sbin/iptables -A waverid -i eth1 -s 64.251.68.19/32
/usr/sbin/iptables -A waverid -i eth0 -d 64.251.69.4/32
/usr/sbin/iptables -A waverid -i eth1 -s 64.251.69.4/32
/usr/sbin/iptables -A waverid -i eth0 -d 10.101.106.2/32
/usr/sbin/iptables -A waverid -i eth1 -s 10.101.106.2/32
--
Aaron Clausen
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
next reply other threads:[~2002-10-07 22:52 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-07 22:52 Aaron Clausen [this message]
2002-10-08 14:17 ` [LARTC] iptables, IP accounting and traffic shaping Stef Coene
2002-10-08 16:32 ` Aaron Clausen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-103403120713695@msgid-missing \
--to=maureen-taocow@alberni.net \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.