[LARTC] iptables, IP accounting and traffic shaping

[LARTC] iptables, IP accounting and traffic shaping

[Aaron Clausen]

I'm having a big problem with a Linux box I have configured as a NAT router
and for IP accounting.  These two functions work without a hitch, but now I
want to do some traffic shaping.  I'm using cbq.init, but have the issue
that no packets are hitting the shaping class.

My machine has two ethernet cards, both on the same subnet, but eth1 being
connected to a number of internal NAT networks.  I'm using proxy arp to pass
data between the two ethernet cards.  I hope the following segment of my
iptables script isn't too big, but it should give a pretty good idea of what
I'm doing.

# beginning of script
/usr/sbin/iptables -F
/usr/sbin/iptables -X
/usr/sbin/iptables -t nat -F
/usr/sbin/iptables -t nat -X
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -P FORWARD ACCEPT
/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT

iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.2 -j DNAT --to 10.102.106.2
iptables -t nat -A POSTROUTING -o eth0 -s 10.102.106.2 -j SNAT --to 64.251.69.2
iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.3 -j DNAT --to 10.101.106.2
iptables -t nat -A POSTROUTING -o eth0 -s 10.101.106.2 -j SNAT --to 64.251.69.3

echo [/etc/rc.d/rc.iptables] Recreating NAT tables...
#iptables -t nat -A POSTROUTING -o eth0 -s 10.101.104.0/21 -d 0/0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -o eth0 -s 10.102.104.0/21 -d 0/0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -o eth0 -s 10.103.104.0/21 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.101.104.0/21 -j SNAT --to 64.251.68.21
iptables -t nat -A POSTROUTING -s 10.102.104.0/21 -j SNAT --to 64.251.68.21
iptables -t nat -A POSTROUTING -s 10.103.104.0/21 -j SNAT --to 64.251.68.21

echo [/etc/rc.d/rc.iptables] Recreating Waverider accounting rules...
/usr/sbin/iptables -N waverid
/usr/sbin/iptables -A FORWARD -j waverid

/usr/sbin/iptables -A waverid -i eth0 -d 64.251.68.19/32
/usr/sbin/iptables -A waverid -i eth1 -s 64.251.68.19/32
/usr/sbin/iptables -A waverid -i eth0 -d 64.251.69.4/32
/usr/sbin/iptables -A waverid -i eth1 -s 64.251.69.4/32

/usr/sbin/iptables -A waverid -i eth0 -d 10.101.106.2/32
/usr/sbin/iptables -A waverid -i eth1 -s 10.101.106.2/32

-- 
Aaron Clausen

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] iptables, IP accounting and traffic shaping

[Stef Coene]

And where is the script you use to shape the traffic ??
My guess is that you have a filter problem.

Stef

On Tuesday 08 October 2002 00:52, Aaron Clausen wrote:
> I'm having a big problem with a Linux box I have configured as a NAT router
> and for IP accounting.  These two functions work without a hitch, but now I
> want to do some traffic shaping.  I'm using cbq.init, but have the issue
> that no packets are hitting the shaping class.
>
> My machine has two ethernet cards, both on the same subnet, but eth1 being
> connected to a number of internal NAT networks.  I'm using proxy arp to
> pass data between the two ethernet cards.  I hope the following segment of
> my iptables script isn't too big, but it should give a pretty good idea of
> what I'm doing.
>
> # beginning of script
> /usr/sbin/iptables -F
> /usr/sbin/iptables -X
> /usr/sbin/iptables -t nat -F
> /usr/sbin/iptables -t nat -X
> /usr/sbin/iptables -t mangle -F
> /usr/sbin/iptables -P FORWARD ACCEPT
> /usr/sbin/iptables -P INPUT ACCEPT
> /usr/sbin/iptables -P OUTPUT ACCEPT
>
> iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.2 -j DNAT --to
> 10.102.106.2 iptables -t nat -A POSTROUTING -o eth0 -s 10.102.106.2 -j SNAT
> --to 64.251.69.2 iptables -t nat -A PREROUTING -i eth0 -d 64.251.69.3 -j
> DNAT --to 10.101.106.2 iptables -t nat -A POSTROUTING -o eth0 -s
> 10.101.106.2 -j SNAT --to 64.251.69.3
>
> echo [/etc/rc.d/rc.iptables] Recreating NAT tables...
> #iptables -t nat -A POSTROUTING -o eth0 -s 10.101.104.0/21 -d 0/0 -j
> MASQUERADE #iptables -t nat -A POSTROUTING -o eth0 -s 10.102.104.0/21 -d
> 0/0 -j MASQUERADE #iptables -t nat -A POSTROUTING -o eth0 -s
> 10.103.104.0/21 -d 0/0 -j MASQUERADE iptables -t nat -A POSTROUTING -s
> 10.101.104.0/21 -j SNAT --to 64.251.68.21 iptables -t nat -A POSTROUTING -s
> 10.102.104.0/21 -j SNAT --to 64.251.68.21 iptables -t nat -A POSTROUTING -s
> 10.103.104.0/21 -j SNAT --to 64.251.68.21
>
> echo [/etc/rc.d/rc.iptables] Recreating Waverider accounting rules...
> /usr/sbin/iptables -N waverid
> /usr/sbin/iptables -A FORWARD -j waverid
>
> /usr/sbin/iptables -A waverid -i eth0 -d 64.251.68.19/32
> /usr/sbin/iptables -A waverid -i eth1 -s 64.251.68.19/32
> /usr/sbin/iptables -A waverid -i eth0 -d 64.251.69.4/32
> /usr/sbin/iptables -A waverid -i eth1 -s 64.251.69.4/32
>
> /usr/sbin/iptables -A waverid -i eth0 -d 10.101.106.2/32
> /usr/sbin/iptables -A waverid -i eth1 -s 10.101.106.2/32

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.oftc.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] iptables, IP accounting and traffic shaping

[Aaron Clausen]

On Tue, 8 Oct 2002, Stef Coene wrote:

> And where is the script you use to shape the traffic ??
> My guess is that you have a filter problem.

Well, I'm using cbq.init, and just had a basic shaping class.  I can shape
traffic providing I just use 64.251.68.21, which is the IP address for eth0.
Unfortunately, I want to be able to shape specific NAT addresses, not just
the whole pie.  This tells me that the packets are never hitting the traffic
shaper.  I just wondered if anybody had any thoughts.

-- 
Aaron Clausen

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/