Iptables and bridge

Iptables and bridge

[Adi]

[-- Attachment #1: Type: text/plain, Size: 387 bytes --]

Hi,

Does anyone ever try traffic accounting using iptables (ipac-ng) in at linux bridge?
I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when i see the
bytes counter using iptables -t mangle -nL -vx, it shown 0. 
But acctually the traffic already flow from eth0,eth1and br0, 
i monitoring by the traffic using tcpdump and iptraf.

Thanks

Regards,

Kris


[-- Attachment #2: Type: text/html, Size: 1226 bytes --]

Re: Iptables and bridge

[Stephen Satchell]

On Tue, 2004-02-17 at 13:12, Adi wrote:
> Hi,
>  
> Does anyone ever try traffic accounting using iptables (ipac-ng) in at
> linux bridge?
> I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when
> i see the
> bytes counter using iptables -t mangle -nL -vx, it shown 0. 
> But acctually the traffic already flow from eth0,eth1and br0, 
> i monitoring by the traffic using tcpdump and iptraf.

Yes.  What I do is use accounting when I have blocked a spammer from
using mail to/from the servers behind my layer-2 firewall.  Everything
is selected by raw interface in the FILTER section.  It's been effective
to demonstrate when a person who has been guilty of spamming before is
possibly starting to spam again.

I haven't played with MANGLE in the layer-2 firewall, but then again my
whole purpose for having one of those beasts is to offload our CISCO
7500 routers and provide some very specific protection for Windows
systems.  I run a mostly-closed firewall for them, and ever since I did
that we have had far fewer problems with them.

Satch

Iptables and SNAT

[Jan Kaastrup]

Hi list
After a reboot of my RedHat mashine, the NAT part of Iptables stop
working.

I get: "iptables: Invalid argument" when using snat.

My snat rule look like this:
$IPTABLES -t nat -A POSTROUTING -o $EXT_INT -j SNAT --to-source $EXT_IP

I have made all netfilter stuff as modules.
#lsmod
ip_conntrack_irc        4336   1  (autoclean)
ip_nat_irc              3440   0  (unused)
ip_conntrack_ftp        5520   1  (autoclean)
ip_nat_ftp              4240   0  (unused)
ipt_ah                  1080   0  (unused)
ipt_esp                 1112   0  (unused)
iptable_nat            22040   2  [ip_nat_irc ip_nat_ftp]
ppp_mppe               24088   0  (autoclean)
bsd_comp                5464   0  (autoclean)
ppp_async               9440   0  (autoclean)
ppp_generic            24508   0  (autoclean) [ppp_mppe bsd_comp
ppp_async]
slhc                    6740   0  (autoclean) [ppp_generic]
ipt_LOG                 4152   1  (autoclean)
ipt_REJECT              4024   1  (autoclean)
ipt_state               1048   5  (autoclean)
iptable_mangle          2776   0  (autoclean) (unused)
ip_conntrack           28296   4  (autoclean) [ip_conntrack_irc
ip_nat_irc ip_conntrack_ftp ip_nat_ftp iptable_nat ipt_state]
iptable_filter          2412   1  (autoclean)
ip_tables              14872  10  [ipt_ah ipt_esp iptable_nat ipt_LOG
ipt_REJECT ipt_state iptable_mangle iptable_filter]

Any hints???

I have tried to recompile iptables - but nothing seems to work - I know
it did before the reboot.
Only thing that has been changed is a static route being enabled, but
this shouldn't make iptables complain:(

Thanks a lot

Re: Iptables and SNAT

[Mark Vevers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday 17 Feb 2004 10:18 am, Jan Kaastrup wrote:
> Hi list
> After a reboot of my RedHat mashine, the NAT part of Iptables stop
> working.
Is the iptable_nat module loaded?  
/sbin/lsmod will list the modules and if any modules are not loaded for
the ruleset then you'll either need to modprobe them beforehand or
alter modules.conf to load them when iptables loads (add below ...)

Cheers
Mark
- -- 
Mark Vevers.    mark@ifl.net / mark@vevers.net
Principal Internet Engineer, Internet for Learning,
Research Machines Plc. (AS5503)
- --
GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB08F3CA3
Fingerprint: 85BA 30C4 9EC8 1792 4C8C   C31E 58B5 3D1C B08F 3CA3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAMfOEWLU9HLCPPKMRAu0XAJ9yVLQ0X3x0XNQ84irLTOVdZPrWUACdGr2Y
udGvM/2ukyptia+Vh/+UX6s=
=t6Ag
-----END PGP SIGNATURE-----