From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Adi" Subject: Iptables and bridge Date: Tue, 17 Feb 2004 13:12:19 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <003001c3f59a$ba6dc2b0$15a02bca@Rangga> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_002D_01C3F557.AC3CC710" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter This is a multi-part message in MIME format. ------=_NextPart_000_002D_01C3F557.AC3CC710 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, Does anyone ever try traffic accounting using iptables (ipac-ng) in at = linux bridge? I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when i = see the bytes counter using iptables -t mangle -nL -vx, it shown 0.=20 But acctually the traffic already flow from eth0,eth1and br0,=20 i monitoring by the traffic using tcpdump and iptraf. Thanks Regards, Kris ------=_NextPart_000_002D_01C3F557.AC3CC710 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi,

Does anyone ever try traffic accounting = using=20 iptables (ipac-ng) in at linux bridge?

I have try using iptables -t mangle -A = PREROUTING=20 -j ACCEPT, but when i see the

bytes counter using iptables -t mangle = -nL -vx, it=20 shown 0.

But acctually the traffic already flow = from eth0,eth1and br0,

i monitoring by the traffic using = tcpdump and=20 iptraf.

Thanks

Regards,

Kris

------=_NextPart_000_002D_01C3F557.AC3CC710-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Satchell Subject: Re: Iptables and bridge Date: Mon, 16 Feb 2004 22:55:17 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1077000917.9435.6.camel@ssatchell1.pyramid.net> References: <003001c3f59a$ba6dc2b0$15a02bca@Rangga> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <003001c3f59a$ba6dc2b0$15a02bca@Rangga> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Adi Cc: netfilter On Tue, 2004-02-17 at 13:12, Adi wrote: > Hi, > > Does anyone ever try traffic accounting using iptables (ipac-ng) in at > linux bridge? > I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when > i see the > bytes counter using iptables -t mangle -nL -vx, it shown 0. > But acctually the traffic already flow from eth0,eth1and br0, > i monitoring by the traffic using tcpdump and iptraf. Yes. What I do is use accounting when I have blocked a spammer from using mail to/from the servers behind my layer-2 firewall. Everything is selected by raw interface in the FILTER section. It's been effective to demonstrate when a person who has been guilty of spamming before is possibly starting to spam again. I haven't played with MANGLE in the layer-2 firewall, but then again my whole purpose for having one of those beasts is to offload our CISCO 7500 routers and provide some very specific protection for Windows systems. I run a mostly-closed firewall for them, and ever since I did that we have had far fewer problems with them. Satch From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Kaastrup" Subject: Iptables and SNAT Date: Tue, 17 Feb 2004 11:18:56 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <004d01c3f53f$73685cf0$2d64a8c0@pcjka> References: <1077000917.9435.6.camel@ssatchell1.pyramid.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1077000917.9435.6.camel@ssatchell1.pyramid.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'netfilter' Hi list After a reboot of my RedHat mashine, the NAT part of Iptables stop working. I get: "iptables: Invalid argument" when using snat. My snat rule look like this: $IPTABLES -t nat -A POSTROUTING -o $EXT_INT -j SNAT --to-source $EXT_IP I have made all netfilter stuff as modules. #lsmod ip_conntrack_irc 4336 1 (autoclean) ip_nat_irc 3440 0 (unused) ip_conntrack_ftp 5520 1 (autoclean) ip_nat_ftp 4240 0 (unused) ipt_ah 1080 0 (unused) ipt_esp 1112 0 (unused) iptable_nat 22040 2 [ip_nat_irc ip_nat_ftp] ppp_mppe 24088 0 (autoclean) bsd_comp 5464 0 (autoclean) ppp_async 9440 0 (autoclean) ppp_generic 24508 0 (autoclean) [ppp_mppe bsd_comp ppp_async] slhc 6740 0 (autoclean) [ppp_generic] ipt_LOG 4152 1 (autoclean) ipt_REJECT 4024 1 (autoclean) ipt_state 1048 5 (autoclean) iptable_mangle 2776 0 (autoclean) (unused) ip_conntrack 28296 4 (autoclean) [ip_conntrack_irc ip_nat_irc ip_conntrack_ftp ip_nat_ftp iptable_nat ipt_state] iptable_filter 2412 1 (autoclean) ip_tables 14872 10 [ipt_ah ipt_esp iptable_nat ipt_LOG ipt_REJECT ipt_state iptable_mangle iptable_filter] Any hints??? I have tried to recompile iptables - but nothing seems to work - I know it did before the reboot. Only thing that has been changed is a static route being enabled, but this shouldn't make iptables complain:( Thanks a lot From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark Vevers Subject: Re: Iptables and SNAT Date: Tue, 17 Feb 2004 10:57:04 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200402171057.08738.mark@vevers.net> References: <004d01c3f53f$73685cf0$2d64a8c0@pcjka> Reply-To: mark@vevers.net Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <004d01c3f53f$73685cf0$2d64a8c0@pcjka> Content-Description: clearsigned data Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: Text/Plain; charset="us-ascii" To: Jan Kaastrup , 'netfilter' =2D----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 17 Feb 2004 10:18 am, Jan Kaastrup wrote: > Hi list > After a reboot of my RedHat mashine, the NAT part of Iptables stop > working. Is the iptable_nat module loaded? =20 /sbin/lsmod will list the modules and if any modules are not loaded for the ruleset then you'll either need to modprobe them beforehand or alter modules.conf to load them when iptables loads (add below ...) Cheers Mark =2D --=20 Mark Vevers. mark@ifl.net / mark@vevers.net Principal Internet Engineer, Internet for Learning, Research Machines Plc. (AS5503) =2D -- GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xB08F3CA3 =46ingerprint: 85BA 30C4 9EC8 1792 4C8C C31E 58B5 3D1C B08F 3CA3 =2D----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAMfOEWLU9HLCPPKMRAu0XAJ9yVLQ0X3x0XNQ84irLTOVdZPrWUACdGr2Y udGvM/2ukyptia+Vh/+UX6s=3D =3Dt6Ag =2D----END PGP SIGNATURE-----