* Counting traffic - another question
@ 2004-07-27 12:34 Marcin
2004-07-27 12:59 ` Antony Stone
0 siblings, 1 reply; 7+ messages in thread
From: Marcin @ 2004-07-27 12:34 UTC (permalink / raw)
To: netfilter
Hi
I have set of rules that doing upload/download stats for my NATed network
(10.0.0.0/8):
# Marking
$IPTABLES -t mangle -A FORWARD -p tcp -j CONNMARK --restore-mark
$IPTABLES -t mangle -A FORWARD -p tcp -m mark ! --mark 0 -j ACCEPT
$IPTABLES -t mangle -A FORWARD -p tcp -m ipp2p --ipp2p -j MARK --set-mark $P2P
$IPTABLES -t mangle -A FORWARD -p tcp --dport $FTP_PORT -j MARK --set-mark $FTP
$IPTABLES -t mangle -A FORWARD -p tcp --dport $SSH_PORT -j MARK --set-mark $SSH
$IPTABLES -t mangle -A FORWARD -p tcp --dport $TELNET_PORT -j MARK --set-mark $SSH
$IPTABLES -t mangle -A FORWARD -p tcp --dport $SMTP_PORT -j MARK --set-mark $SMTP
$IPTABLES -t mangle -A FORWARD -p tcp --dport $HTTP_PORT -j MARK --set-mark $HTTP
$IPTABLES -t mangle -A FORWARD -p tcp --dport $HTTPS_PORT -j MARK --set-mark $HTTPS
$IPTABLES -t mangle -A FORWARD -p tcp --dport $POP3_PORT -j MARK --set-mark $POP3
$IPTABLES -t mangle -A FORWARD -p tcp --dport $IRC_PORT -j MARK --set-mark $IRC
$IPTABLES -t mangle -A FORWARD -p tcp -j CONNMARK --save-mark
Rules above (IMO) marks specified trafic traveling through FORWARD
chain, and this is only traffic from localnet <-> internet, not from
localnet <-> linuxbox.
Ok, now i make chains for counting uploads/downloads from/to my
lan.
$IPTABLES -t mangle -N statsin
$IPTABLES -t mangle -N statsout
My internet interface is ppp0 ($INET_IF), and lan is connected to
eth0 ($LOCAL_IF). So, with rules below I send packets leaving my box
with ppp0 to statsout chain, and with eth0 to statsin.
$IPTABLES -t mangle -A POSTROUTING -o $INET_IF -j statsout
$IPTABLES -t mangle -A POSTROUTING -o $LOCAL_IF -j statsin
And here is real counting. Note, that $OTHER is for not marked
packets.
$IPTABLES -t mangle -A statsin -m mark --mark $P2P
$IPTABLES -t mangle -A statsin -m mark --mark $FTP
$IPTABLES -t mangle -A statsin -m mark --mark $SSH
$IPTABLES -t mangle -A statsin -m mark --mark $SMTP
$IPTABLES -t mangle -A statsin -m mark --mark $HTTP
$IPTABLES -t mangle -A statsin -m mark --mark $POP3
$IPTABLES -t mangle -A statsin -m mark --mark $IRC
$IPTABLES -t mangle -A statsin -m mark --mark $OTHER
$IPTABLES -t mangle -A statsout -m mark --mark $P2P
$IPTABLES -t mangle -A statsout -m mark --mark $FTP
$IPTABLES -t mangle -A statsout -m mark --mark $SSH
$IPTABLES -t mangle -A statsout -m mark --mark $SMTP
$IPTABLES -t mangle -A statsout -m mark --mark $HTTP
$IPTABLES -t mangle -A statsout -m mark --mark $POP3
$IPTABLES -t mangle -A statsout -m mark --mark $IRC
$IPTABLES -t mangle -A statsout -m mark --mark $OTHER
Ok, this works fine for me. But there is one thing, that wondering
me. I want to count only traffic from lan <-> internet. But these
rules:
$IPTABLES -t mangle -A POSTROUTING -o $INET_IF -j statsout
$IPTABLES -t mangle -A POSTROUTING -o $LOCAL_IF -j statsin
should also match packets generated on linuxbox destined to lan or
internet. Is that true? These packets are not marked, so my rules
count them as $OTHER.
I dont want count these packets, so I wrote 2 new rules
$IPTABLES -t mangle -A FORWARD -s 10.0.0.0/8 -j statsout
$IPTABLES -t mangle -A FORWARD -d 10.0.0.0/8 -j statsin
but this dont work :(
So how can I count trafic only from lan <-> internet?
PS. Yes, I know, my english is tragic :D
--
Pozdrawiam
Marcin mailto:slacklist@op.pl
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Counting traffic - another question
2004-07-27 12:34 Counting traffic - another question Marcin
@ 2004-07-27 12:59 ` Antony Stone
2004-07-27 13:52 ` Re[2]: " Marcin Sura
2004-07-27 13:57 ` Marcin Sura
0 siblings, 2 replies; 7+ messages in thread
From: Antony Stone @ 2004-07-27 12:59 UTC (permalink / raw)
To: netfilter
On Tuesday 27 July 2004 1:34 pm, Marcin wrote:
> Hi
>
> I have set of rules that doing upload/download stats for my NATed network
> (10.0.0.0/8):
>
> # Marking
> $IPTABLES -t mangle -A FORWARD -p tcp -j CONNMARK --restore-mark
> $IPTABLES -t mangle -A FORWARD -p tcp -m mark ! --mark 0 -j ACCEPT
>
> $IPTABLES -t mangle -A FORWARD -p tcp --dport $SSH_PORT -j MARK --set-mark
> $SSH
<snip...>
> Rules above (IMO) marks specified trafic traveling through FORWARD
> chain, and this is only traffic from localnet <-> internet, not from
> localnet <-> linuxbox.
Correct. FORWARD chain matches only packets which are routed *through* the
machine, not packets going to/from the machine itself.
> Ok, now i make chains for counting uploads/downloads from/to my lan.
Why? You seem to have one set of rules in the FORWARD mangle table for
MARKing packets, and then another set of rules in POSTROUTING looking for
MARKs and counting the packets.
Why not simply count all the packets in FORWARD mangle?
For example:
iptables -A FORWARD -t mangle -i eth0 -o ppp0 -p tcp --dport ssh
Will count all packets going from eth0 to ppp0 destination ssh (TCP port 22).
No need to MARK the packets (unless you want the MARKs for something else?),
and you can specify input & output interface in the FORWARD table to identify
which way through your firewall the packets are going.
Regards,
Antony.
--
Most people have more than the average number of legs.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re[2]: Counting traffic - another question
2004-07-27 12:59 ` Antony Stone
@ 2004-07-27 13:52 ` Marcin Sura
2004-07-27 13:57 ` Marcin Sura
1 sibling, 0 replies; 7+ messages in thread
From: Marcin Sura @ 2004-07-27 13:52 UTC (permalink / raw)
To: Antony Stone
Witam
Tuesday, July 27, 2004, 2:59:13 PM, you wrote:
> No need to MARK the packets (unless you want the MARKs for something else?),
Yes, I need MARKs for traffic shaping. Sorry, I forgot to mention this.
> and you can specify input & output interface in the FORWARD table to identify
> which way through your firewall the packets are going.
$IPTABLES -t mangle -A FORWARD -i $LOCAL_IF -o $INET_IF -j statsout
$IPTABLES -t mangle -A FORWARD -i $INET_IF -o $LOCAL_IF -j statsin
--
Pozdrawiam
Marcin mailto:slacklist@op.pl
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re[2]: Counting traffic - another question
2004-07-27 12:59 ` Antony Stone
2004-07-27 13:52 ` Re[2]: " Marcin Sura
@ 2004-07-27 13:57 ` Marcin Sura
2004-07-27 14:26 ` Antony Stone
1 sibling, 1 reply; 7+ messages in thread
From: Marcin Sura @ 2004-07-27 13:57 UTC (permalink / raw)
To: Antony Stone
Witam
Sorry for my previous mail ;) I press enter in wrong time :)
Tuesday, July 27, 2004, 2:59:13 PM, you wrote:
> No need to MARK the packets (unless you want the MARKs for something else?),
Yes, I need MARKs for traffic shaping. Sorry, I forgot to mention this.
> and you can specify input & output interface in the FORWARD table to identify
> which way through your firewall the packets are going.
Ok, so I change the rules (i still use statsin and statsout for ...
hmm ... order :)
$IPTABLES -t mangle -A FORWARD -i $LOCAL_IF -o $INET_IF -j statsout
$IPTABLES -t mangle -A FORWARD -i $INET_IF -o $LOCAL_IF -j statsin
And this dont work :( I mean rules in statsout statsin incorrectly
count trafic :(
What's wrong?
--
Pozdrawiam
Marcin mailto:slacklist@op.pl
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Re[2]: Counting traffic - another question
2004-07-27 13:57 ` Marcin Sura
@ 2004-07-27 14:26 ` Antony Stone
2004-07-27 15:27 ` Re[4]: " Marcin Sura
2004-07-27 21:57 ` Marcin Sura
0 siblings, 2 replies; 7+ messages in thread
From: Antony Stone @ 2004-07-27 14:26 UTC (permalink / raw)
To: netfilter
On Tuesday 27 July 2004 2:57 pm, Marcin Sura wrote:
> Tuesday, July 27, 2004, 2:59:13 PM, you wrote:
> > No need to MARK the packets (unless you want the MARKs for something
> > else?),
>
> Yes, I need MARKs for traffic shaping. Sorry, I forgot to mention this.
Okay, no problem, continue MARKing them then, but I still think you can count
them in FORWARD mangle.
> > and you can specify input & output interface in the FORWARD table to
> > identify which way through your firewall the packets are going.
>
> Ok, so I change the rules (i still use statsin and statsout for ...
> hmm ... order :)
>
> $IPTABLES -t mangle -A FORWARD -i $LOCAL_IF -o $INET_IF -j statsout
> $IPTABLES -t mangle -A FORWARD -i $INET_IF -o $LOCAL_IF -j statsin
No, don't put the "-j statsout" or "-j statsin" at the end. The rule I
suggested previously is actually complete:
iptables -A FORWARD -t mangle -i eth0 -o ppp0 -p tcp --dport ssh
You do not need to have a "-j target" at the end of a rule if you don't want
one. The above rule will still count the packets, and you can see the
packet/byte counters with "iptables -L FORWARD -t mangle -nvx".
Regards,
Antony.
--
"It would appear we have reached the limits of what it is possible to achieve
with computer technology, although one should be careful with such
statements; they tend to sound pretty silly in five years."
- John von Neumann (1949)
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re[4]: Counting traffic - another question
2004-07-27 14:26 ` Antony Stone
@ 2004-07-27 15:27 ` Marcin Sura
2004-07-27 21:57 ` Marcin Sura
1 sibling, 0 replies; 7+ messages in thread
From: Marcin Sura @ 2004-07-27 15:27 UTC (permalink / raw)
To: Antony Stone
[-- Attachment #1: Type: text/plain, Size: 893 bytes --]
Witam
Tuesday, July 27, 2004, 4:26:15 PM, you wrote:
>> $IPTABLES -t mangle -A FORWARD -i $LOCAL_IF -o $INET_IF -j statsout
>> $IPTABLES -t mangle -A FORWARD -i $INET_IF -o $LOCAL_IF -j statsin
> You do not need to have a "-j target" at the end of a rule if you don't want
> one. The above rule will still count the packets, and you can see the
> packet/byte counters with "iptables -L FORWARD -t mangle -nvx".
Ok, i'll try this, but im still wondering why my rules works
incorrectly. In theory (my theory :) first rule redirects packets
lan -> internet to statsout, and in statsout chain they are counted by
type of traffic.
The same goes to second rule, but there is internet -> lan traffic
redirected.
But unfortunately this won't work that way. Why? Output form iptables
-t mangle -L -vn is attached.
--
Pozdrawiam
Marcin mailto:slacklist@op.pl
[-- Attachment #2: output.txt --]
[-- Type: text/plain, Size: 4244 bytes --]
root@serwer:/etc/rc.d# iptables -t mangle -L -vn
Chain PREROUTING (policy ACCEPT 279K packets, 52M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 19339 packets, 2118K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 190K packets, 16M bytes)
pkts bytes target prot opt in out source destination
50145 25M CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK restore
47938 25M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 MARK match !0x0
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 ipp2p v0.6 --ipp2p MARK set 0x1
3 144 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 MARK set 0x4
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 MARK set 0x3
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23 MARK set 0x3
2 96 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 MARK set 0x5
1491 71488 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 MARK set 0x2
8 384 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 MARK set 0x2
100 4800 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 MARK set 0x6
0 0 MARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:6667 MARK set 0x7
2207 122K CONNMARK tcp -- * * 0.0.0.0/0 0.0.0.0/0 CONNMARK save
2150 107K statsout all -- eth0 ppp0 0.0.0.0/0 0.0.0.0/0
562 81524 statsin all -- ppp0 eth0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 21282 packets, 1313K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 281K packets, 51M bytes)
pkts bytes target prot opt in out source destination
61681 25M TTL all -- * * 0.0.0.0/0 0.0.0.0/0 TTL set to 128
Chain statsin (1 references)
pkts bytes target prot opt in out source destination
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x1
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x4
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x3
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x5
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x2
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x6
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x7
562 81524 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x0
Chain statsout (1 references)
pkts bytes target prot opt in out source destination
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x1
3 144 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x4
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x3
2 96 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x5
1499 71872 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x2
100 4800 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x6
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x7
546 29999 all -- * * 0.0.0.0/0 0.0.0.0/0 MARK match 0x0
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re[4]: Counting traffic - another question
2004-07-27 14:26 ` Antony Stone
2004-07-27 15:27 ` Re[4]: " Marcin Sura
@ 2004-07-27 21:57 ` Marcin Sura
1 sibling, 0 replies; 7+ messages in thread
From: Marcin Sura @ 2004-07-27 21:57 UTC (permalink / raw)
To: Antony Stone
Witam
Tuesday, July 27, 2004, 4:26:15 PM, you wrote:
> No, don't put the "-j statsout" or "-j statsin" at the end. The rule I
> suggested previously is actually complete:
> iptables -A FORWARD -t mangle -i eth0 -o ppp0 -p tcp --dport ssh
--
Pozdrawiam
Marcin mailto:slacklist@op.pl
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2004-07-27 21:57 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-07-27 12:34 Counting traffic - another question Marcin
2004-07-27 12:59 ` Antony Stone
2004-07-27 13:52 ` Re[2]: " Marcin Sura
2004-07-27 13:57 ` Marcin Sura
2004-07-27 14:26 ` Antony Stone
2004-07-27 15:27 ` Re[4]: " Marcin Sura
2004-07-27 21:57 ` Marcin Sura
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox