[LARTC] IMQ

[LARTC] IMQ

[Arindam Haldar]

hi all,
i want to use IMQ with iptables1.2.7a
i have been using it with iptables 1.2.6a & it works well..
i patched it with iptables 1.2.7a & it went well but when i use .runme 
for patch-o-matic the IMQ option didnt come.
what i have to do to enable IMQ with iptables 1.2.7a for linux kernel 
2.4.19 ?
awaiting a reply
A.H

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IMQ

[Tomasz Wrona]

On Wed, 9 Oct 2002, Arindam Haldar wrote:

> what i have to do to enable IMQ with iptables 1.2.7a for linux kernel
> 2.4.19 ?

launch ./runme extra

tw
-- 

----------------
 ck.eter.tym.pl

"Never let shooling disturb Your education"

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IMQ

[Arindam Haldar]

Tomasz Wrona wrote:
> On Wed, 9 Oct 2002, Arindam Haldar wrote:
> 
>>what i have to do to enable IMQ with iptables 1.2.7a for linux kernel
>>2.4.19 ?
> 
> launch ./runme extra
i did that !
i first patched IMQ going into iptables1.2.7a directory & then changing 
to patch-o-matic directory did--> ./runme extra
but the IMQ option didnt come !!
did i miss any step ??

> 
> tw


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IMQ

[Alexey Talikov]

[-- Attachment #1: Type: text/plain, Size: 563 bytes --]

Hello Arindam,
I recommend you wait release from Patrick
But if you wish try this.
NOT OFFICAL !!!!
AT THIS TIME WORK !! ONLY !!! FOR ME.

Brief instruction:

cd iptables-1.2.7a
patch -p1 < ../iptables-1.2.7a-imq.diff
chmod a+x extensions/.IMQ-test
chmod a+x extensions/.IMQ-test6

cd linux-2.4.19
patch -p1 < ../imq-2.4.19.diff

cd patch-o-matic-YYYYMMDD
patch -p1 < ../pom-imq.diff
./runme extra

Recompile kernel and iptables.

-----------------------------------
mailto:alexey_talikov@texlab.com.uz
BR
Alexey Talikov
FORTEK
-----------------------------------

[-- Attachment #2: imq.tar.bz2 --]
[-- Type: application/octet-stream, Size: 6681 bytes --]

Re: [LARTC] IMQ

[Arindam Haldar]

thanx so much ... :)
ys i will wait for release from Patric, but will try ur suggestion


Alexey Talikov wrote:
> Hello Arindam,
> I recommend you wait release from Patrick
> But if you wish try this.
> NOT OFFICAL !!!!
> AT THIS TIME WORK !! ONLY !!! FOR ME.
> 
> Brief instruction:
> 
> cd iptables-1.2.7a
> patch -p1 < ../iptables-1.2.7a-imq.diff
> chmod a+x extensions/.IMQ-test
> chmod a+x extensions/.IMQ-test6
> 
> cd linux-2.4.19
> patch -p1 < ../imq-2.4.19.diff
> 
> cd patch-o-matic-YYYYMMDD
> patch -p1 < ../pom-imq.diff
> ./runme extra
> 
> Recompile kernel and iptables.
> 
> -----------------------------------
> mailto:alexey_talikov@texlab.com.uz
> BR
> Alexey Talikov
> FORTEK
> -----------------------------------


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] IMQ

[Rimas]

Hi folks,

I would like to use the IMQ device and what I have to apply (patches) for
the kernel 2.4.19 and iptables 1.2.7a?

Thank you

Rimas

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IMQ

[Stef Coene]

On Tuesday 26 November 2002 11:02, Rimas wrote:
> Hi folks,
>
> I would like to use the IMQ device and what I have to apply (patches) for
> the kernel 2.4.19 and iptables 1.2.7a?
See the IMQ pages :
http://trash.net/~kaber/imq

Stef

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.oftc.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] IMQ

[Aaron Clausen]

Has anybody got imq running on iptables 1.2.7a.  The home page for imq only
seems to have a patch for 1.2.6a.

-- 
Aaron Clausen

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IMQ

[Alexey Sheshka]

On Mon, 2 Dec 2002 09:30:04 -0800 (PST)
Aaron Clausen <maureen-taocow@alberni.net> wrote:

> Has anybody got imq running on iptables 1.2.7a.  The home page for imq only
> seems to have a patch for 1.2.6a.

I'm successfully run iptables 1.2.7a with patch from IMQ homepage.
The thing what I only does to get it work, replace strings contais 
NETFILTER_VERSION  to "1.2.7a" in libipt_IMQ.c and  libip6t_IMQ.c . 


> 
> -- 
> Aaron Clausen
> 
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/


-- 
Sheshka Aleksey
Senior Security Administrator

PGP key : http://pgp.dtype.org:11371/pks/lookup?op=get&search=0x0BE90515
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] IMQ

[Yans van Horn]

Hello

I have a server with a dsl connection on eth1 and local interface eth0.
Because of the NAT i cannot direct traffic to IMQ device in PREROUTING chain
but have to use INPUT and FORWARD. So i use rules.

iptables -t mangle -A INPUT -i eth1 -j IMQ --todev 0
iptables -t mangle -A FORWARD -i eth1 -j IMQ --todev 0

And now the strange thing: FORWARD traffic gets directed nicely to the IMQ,
but INPUT *doesn't* !

To be just sure i removed "FORWARD" line and left only the "INPUT" (other
mangle rules were removed)

Chain INPUT (policy ACCEPT 3511 packets, 2753307 bytes)
    pkts      bytes target     prot opt in     out     source
destination
     343   439847 IMQ        all  --  eth1   any     anywhere
anywhere           IMQ: todev 0

But when i check IMQ0 using ifconfig:

imq0      Link encap:UNSPEC  HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          UP RUNNING NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:30
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

i see there is no traffic going through this device!

Anyone knows how can it be possible ?

--
best regards,
Marcin 'Yans' Bazarnik
yans@majora.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] IMQ

[David Watson]

[-- Attachment #1: Type: text/plain, Size: 278 bytes --]

         I asked Patrick about NAT and IMQ and he referred me to an archive 
post on this:
http://mailman.ds9a.nl/pipermail/lartc/2002q3/004725.html

I have applied this patch and it is working as expected.

Contents included below:

This is a multi-part message in MIME format.

[-- Attachment #2: Type: text/plain, Size: 2432 bytes --]

sorry last patch was broken, this one is ok.
patrick

Patrick McHardy wrote:

 > Hi Daniel,
 >
 > Daniel Sercaianu wrote:
 >
 >> I have the following problems:
 >> I cannot shape the ip xxx.xxx.xxx.xxx when I do SNAT or MASQUERADE with
 >> them. Otherwise when I remove these two iptables lines the shaping works
 >> perfectly.
 >>
 >> It is very important for me to shape the xxx.xxx.xxx.xxx ip and not the
 >> yyy.yyy.yyy.yyy. When I tried to shape yyy.yyy.yyy.yyy, it worked.
 >>
 >> What rules should be added to make this possible?
 >>
 >>
 >> My iptables rules are:
 >>
 >> iptables -A PREROUTING -t mangle -s xxx.xxx.xxx.xxx -j MARK  --set-mark 1
 >> iptables -A POSTROUTING -t nat -s xxx.xxx.xxx.xxx -j SNAT --to
 >> zzz.zzz.zzz.zzz -o eth4
 >>
 >>
 >>
 >> iptables -t mangle -I PREROUTING -j IMQ
 >> ip link set imq0 up
 >>
 >>
 >> ip rule shows the following output:
 >>
 >> 32764:  from zzz.zzz.zzz.0/24 lookup ew
 >> 32765:  from all fwmark        1 lookup ew
 >> 32766:  from all lookup main
 >> 32767:  from all lookup default
 >>
 >>
 >>
 >>
 >> My tc + htb rule look like this:
 >>
 >> /sbin/tc qdisc add dev imq0 root handle 1: htb default 200 r2q 3
 >> /sbin/tc class add dev imq0 parent 1:0 classid 1:1 htb rate 100Mbit
 >> ceil 100Mbit burst 2k prio 5
 >>
 >> /sbin/tc filter add dev imq0 parent 1:0 protocol ip prio 5 handle 1:
 >> u32 divisor 256
 >>
 >> /sbin/tc class add dev imq0 parent 1:1 classid 1:2 htb rate 512kbit
 >> ceil 512kbit burst 2k prio 5
 >> /sbin/tc qdisc add dev imq0 parent 1:2 handle 10: sfq quantum 1514b
 >> perturb 10
 >> /sbin/tc filter add dev imq0 parent 1:0 protocol ip prio 5 u32 match
 >> ip dst xxx.xxx.xxx.xxx flowid 1:2
 >
 >
 >
 > If i understood you right this is probably not working because imq sees
 > packets before zzz.zzz.zzz.zzz is dnated back to xxx.xxx.xxx.xxx. please
 > try the attached patch.
 >
 >
 > bye
 >
 > patrick
 >
 >
 > ------------------------------------------------------------------------
 >
 > --- imq.c.origSun Aug 11 15:30:24 2002
 > +++ imq.cSun Aug 11 15:31:17 2002
 > @@ -37,7 +37,7 @@
 >  imq_nf_hook,
 >  PF_INET,
 >  NF_IP_PRE_ROUTING,
 > -NF_IP_PRI_MANGLE + 1
 > +NF_IP_PRI_NAT_DST + 1
 >  };
 >
 >  static struct nf_hook_ops imq_egress_ipv4 = {
 > @@ -54,7 +54,7 @@
 >  imq_nf_hook,
 >  PF_INET6,
 >  NF_IP6_PRE_ROUTING,
 > -NF_IP6_PRI_MANGLE + 1
 > +NF_IP6_PRI_NAT_SRC + 1
 >  };
 >
 >  static struct nf_hook_ops imq_egress_ipv6 = {
 >


[-- Attachment #3: imqnat.diff --]
[-- Type: text/plain, Size: 405 bytes --]

--- imq.c.origSun Aug 11 15:30:24 2002
+++ imq.cSun Aug 11 15:31:17 2002
@@ -37,7 +37,7 @@
  imq_nf_hook,
  PF_INET,
  NF_IP_PRE_ROUTING,
-NF_IP_PRI_MANGLE + 1
+NF_IP_PRI_NAT_DST + 1
  };

  static struct nf_hook_ops imq_egress_ipv4 = {
@@ -54,7 +54,7 @@
  imq_nf_hook,
  PF_INET6,
  NF_IP6_PRE_ROUTING,
-NF_IP6_PRI_MANGLE + 1
+NF_IP6_PRI_NAT_DST + 1
  };

  static struct nf_hook_ops imq_egress_ipv6 = {

[LARTC] IMQ

[Dariusz Dwornikowski]

ive got such network:


|--------|   |-------------|
| WORLD  |---|ROUTER/server| ------ NATED LAN
|--------|   |-------------|


I want to use imq on ROUTER, what behaviour to choose ? AA, BA, AB, BB ??





-- 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Andreas Unterkircher]

Dariusz Dwornikowski (tdi@pozman.pl) schrieb:
> I want to use imq on ROUTER, what behaviour to choose ? AA, BA, AB, BB ??

That depends on what you want to do. For example:

*) BA - If you want to have all packets on the IMQ after the nat table - so
you wouldn't see any internal ips anymore on the IMQ device.
*) BB - If you want to have packets with internal ips on the IMQ before the
pass the nat table. But you can't match on your external IP with BB.

Cheers,
Andreas

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Dariusz Dwornikowski]

> Dariusz Dwornikowski (tdi@pozman.pl) schrieb:
>> I want to use imq on ROUTER, what behaviour to choose ? AA, BA, AB, BB
>> ??
>
> That depends on what you want to do. For example:
>
> *) BA - If you want to have all packets on the IMQ after the nat table -
> so
> you wouldn't see any internal ips anymore on the IMQ device.
> *) BB - If you want to have packets with internal ips on the IMQ before
> the
> pass the nat table. But you can't match on your external IP with BB.

yes but i want to have two IMQ devices... for outside eth and inside eth



-- 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Andreas Unterkircher]

> yes but i want to have two IMQ devices... for outside eth and inside eth

Ahmm.. don't know what you mean with that. But if you have a external
Interface (ex eth0) on which you want to shape egress and also ingress shaping
you simply do:

ip link set imq0 up
ip link set imq1 up

${IPTABLES} -t mangle -I PREROUTING -i ${EXT_DEV} -j IMQ --todev 0
${IPTABLES} -t mangle -I POSTROUTING -o ${EXT_DEV} -j IMQ --todev 1

and put your QoS on imq0 and imq1...

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Dariusz Dwornikowski]

>> yes but i want to have two IMQ devices... for outside eth and inside eth
>
> Ahmm.. don't know what you mean with that. But if you have a external
> Interface (ex eth0) on which you want to shape egress and also ingress
> shaping
> you simply do:
>
> ip link set imq0 up
> ip link set imq1 up
>
> ${IPTABLES} -t mangle -I PREROUTING -i ${EXT_DEV} -j IMQ --todev 0
> ${IPTABLES} -t mangle -I POSTROUTING -o ${EXT_DEV} -j IMQ --todev 1
>
> and put your QoS on imq0 and imq1...

i want to shape traffic for my clients and do not know what behaviour to
choose...
in your example will it be possible to match NATed addresses of my clients ?



-- 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Andreas Unterkircher]

> i want to shape traffic for my clients and do not know what behaviour to
> choose...
> in your example will it be possible to match NATed addresses of my clients ?

you want to match the translated addresses of your clients (-> external IP) -
then BA is the correct behaviour.

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Dariusz Dwornikowski]

>> i want to shape traffic for my clients and do not know what behaviour to
>> choose...
>> in your example will it be possible to match NATed addresses of my
>> clients ?
>
> you want to match the translated addresses of your clients (-> external
> IP) -
> then BA is the correct behaviour.
>

no i want match their private addresses.
i want imq0 for ext_if and imq1 for internal_if..

so i can traffic shaping on matched NATed ips


-- 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Andreas Unterkircher]

> no i want match their private addresses.
> i want imq0 for ext_if and imq1 for internal_if..
>
> so i can traffic shaping on matched NATed ips

Oh ok. I was irritated because you say NATed ips - for me this are all clients
after the passed the nat table...

So you ned BB. IMQ hook before the postrouting table (where your NAT will
happen) and you have internal addresses on the imq device.

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] IMQ

[Dariusz Dwornikowski]

>> no i want match their private addresses.
>> i want imq0 for ext_if and imq1 for internal_if..
>>
>> so i can traffic shaping on matched NATed ips
>
> Oh ok. I was irritated because you say NATed ips - for me this are all
> clients
> after the passed the nat table...
>
> So you ned BB. IMQ hook before the postrouting table (where your NAT will
> happen) and you have internal addresses on the imq device.
>
>

thank you very much.
-- 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc