PREROUTING table and quota

[Michael <micolous@gmail.com>]

Howdy,

I'm having some issues using the quota module in the PREROUTING table.

I'm trying to write a captive portal software, and a requirement of it
is to have the client be automatically redirected to a login page on
HTTP requests where the user has no quota remaining or isn't logged in,
and it is not a request to a "free" site.

The firewall is being rewritten by a daemon which the web frontend
connects to.  On startup, the daemon sets up a basic NAT and all the
standard rules, then when a user logs in the webpage connects to the
daemon and issues commands like "add computer at <ip> <mac> to userid
<n>".  The daemon is fairly dumb and doesn't retain any state data -
it's only there to insulate the web server and application from
requiring root.

As far as I can tell, not all packets are actually hitting my quota
rules.  Instead only new connections seem to be managed correctly -
subsequent and return packets are unaffected, and thus uncounted.

The rules are a bit messy, what I'm trying to achieve and the ordering
is:
     1. p2_unmetered: Unmetered/free locations are sent to the
        p2_allowed chain.
     2. p2_blacklist: Blacklisted locations are sent to the p2_captive
        chain.
     3. p2_users: Maps a host to a user chain (p2u_*).  This allows one
        user to be signed on from many hosts.
     4. p2_captive: All unhandled traffic is sent to this chain.

In p2_allowed:
      * All traffic is allowed through.

In p2_captive:
      * All tcp traffic on port 80 to be redirected to the local port
        998 (which is a small web server that redirects users to the
        captive portal login page)
      * All tcp traffic on other ports are redirected to the local port
        997
      * All icmp traffic is redirected to the local machine
      * All other traffic is dropped

In p2u_*:
      * If there is enough quota for the packet, it is sent to
        p2_allowed, and the size of the packet is subtracted from the
        quota.
      * If there is insufficient quota, it should not end processing
        (and goto p2_captive)

The network setup:
  eth0 (172.20.0.147): The external interface on the gateway.
  eth1 (10.13.37.3): The internal interface on the gateway.
  10.13.37.254: A client PC I'm using for testing.

Here is a dump of my iptables rules:

# Generated by iptables-save v1.3.6 on Thu Nov 13 21:22:03 2008
*filter
:INPUT ACCEPT [2765:294789]
:FORWARD ACCEPT [77631:59364457]
:OUTPUT ACCEPT [3210:423042]
COMMIT
# Completed on Thu Nov 13 21:22:03 2008
# Generated by iptables-save v1.3.6 on Thu Nov 13 21:22:03 2008
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [750:56421]
:OUTPUT ACCEPT [907:68008]
:p2_allowed - [0:0]
:p2_blacklist - [0:0]
:p2_captive - [0:0]
:p2_hosts - [0:0]
:p2_unmetered - [0:0]
:p2u_12 - [0:0]
-A PREROUTING -j p2_unmetered 
-A PREROUTING -j p2_blacklist 
-A PREROUTING -j p2_hosts 
-A PREROUTING -j p2_captive 
-A POSTROUTING -o eth0 -j MASQUERADE 
-A p2_allowed -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A p2_allowed -i eth1 -j ACCEPT 
-A p2_blacklist -d 192.168.0.0/255.255.0.0 -j p2_captive 
-A p2_captive -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 998 
-A p2_captive -p tcp -j REDIRECT --to-ports 997 
-A p2_captive -p icmp -j REDIRECT 
-A p2_captive -j DROP 
-A p2_hosts -s 10.13.37.254 -i eth1 -m mac --mac-source
00:02:XX:XX:XX:XX -j p2u_12 
-A p2_hosts -d 10.13.37.254 -o eth1 -j p2u_12
-A p2_unmetered -d 10.13.37.3 -p tcp -m tcp --dport 80 -j ACCEPT 
-A p2_unmetered -d 10.13.37.3 -p tcp -m tcp --dport 443 -j ACCEPT 
-A p2_unmetered -d 10.13.37.3 -p tcp -m tcp --dport 53 -j ACCEPT 
-A p2_unmetered -d 10.13.37.3 -p udp -m udp --dport 53 -j ACCEPT 
-A p2_unmetered -d 172.20.0.147 -j ACCEPT 
-A p2_unmetered -d 10.13.37.3 -p tcp -m tcp --dport 22 -j ACCEPT 
-A p2_unmetered -d 10.13.37.3 -p tcp -m tcp --dport 998 -j ACCEPT
-A p2u_12 -m quota --quota 999705946 -j p2_allowed 
COMMIT
# Completed on Thu Nov 13 21:22:03 2008

Versions of stuff:
      * iptables v1.3.6
      * kernel 2.6.18
      * Debian 4.0 (etch/stable) i386

I've had this previously working correctly when I was doing the work in
the FORWARD chain of the filter rule, however I cannot do automatic
redirection to the login page using this method.

Any advice would be greatly appreciated.

Cheers!


--michael