IPTables script problem...

IPTables script problem...

[Don Gould]

Can anyone tell me why this isn't working?

If I add the ip to the filter manually from the cmd line then it works,
if I try to do it in the script is doesn't.

 From below...

iptables -A traffic_in -d $3  >> /home/shared/dhcpconnect.log
iptables -A traffic_out -s $3  >> /home/shared/dhcpconnect.log

doesn't seem to add the IP, but...

iptables -A traffic_out -s 192.168.3.151

will work just fine...

Chain traffic_in (4 references)
  pkts bytes target     prot opt in     out     source
destination
  7707 4745K            all  --  *      *       0.0.0.0/0
192.168.2.148
   678  529K            all  --  *      *       0.0.0.0/0
192.168.2.136
Chain traffic_out (3 references)
  pkts bytes target     prot opt in     out     source
destination
  7402 1328K            all  --  *      *       192.168.2.148
0.0.0.0/0
   582 95736            all  --  *      *       192.168.2.136
0.0.0.0/0
     0     0            all  --  *      *       192.168.3.151
0.0.0.0/0

As you can see, I only added 151 to one filter manually.  It should have
been added automatically when the script was next called by dnsmasq.


==== And now for the offending script...


[root@bowenvale shared]# cat dhcp.src
#!/bin/sh
nowdate=$(date)
# echo $nowdate, $0, $1, $2, $3 >> /home/shared/dhcpconnect.log

echo $nowdate, $2, $3 >> /home/shared/dhcpconnect.log

echo "Start" >> /home/shared/dhcpconnect.log

mysql -h bowenvale -u oncs -pbutterfly -e "INSERT INTO
oncs.tblSessionRequest (MACAddress, IPAddress) VALUES('$2', '$3
    ');" &> /home/shared/dhcpconnect.log

echo "Done - database log" >> /home/shared/dhcpconnect.log

# Now we start the data accounting bit using IP tables...
# Make sure the iptables rules exist!  This should return errors because
these rules should always already exist.
iptables -N traffic_in  >> /home/shared/dhcpconnect.log
iptables -N traffic_out  >> /home/shared/dhcpconnect.log

echo $nowdate, $2, $3 >> /home/shared/dhcpconnect.log

echo "Done - rule create" >> /home/shared/dhcpconnect.log

# Create Rule for IP to count the data.
iptables -A traffic_in -d $3  >> /home/shared/dhcpconnect.log
iptables -A traffic_out -s $3  >> /home/shared/dhcpconnect.log

echo "Done - counter add" >> /home/shared/dhcpconnect.log

#add chains as target to FORWARD rule - after the first time, this
should always be already done.
iptables -I FORWARD 1 -j traffic_in  >> /home/shared/dhcpconnect.log
iptables -I FORWARD 2 -j traffic_out  >> /home/shared/dhcpconnect.log


echo "Done forward rule add" >> /home/shared/dhcpconnect.log

echo "Done", $2, $3  >> /home/shared/dhcpconnect.log



[root@bowenvale shared]#



Cheers Don
-- 
Don Gould
www.thinkdesignprint.co.nz - www.tcn.bowenvale.co.nz -
www.bowenvale.co.nz - www.hearingbooks.co.nz - www.buxtonsquare.co.nz -
SkypeMe:  ThinkDesignPrint - Good ideas:  www.solarking.co.nz

Re: IPTables script problem...

[Gáspár Lajos]

Don Gould írta:
> Can anyone tell me why this isn't working?
>
...
>
> [root@bowenvale shared]# cat dhcp.src
> #!/bin/sh
For debug try this:

#!/bin/bash -x

> nowdate=$(date)
> # echo $nowdate, $0, $1, $2, $3 >> /home/shared/dhcpconnect.log
>
> echo $nowdate, $2, $3 >> /home/shared/dhcpconnect.log
>
> echo "Start" >> /home/shared/dhcpconnect.log
>
> mysql -h bowenvale -u oncs -pbutterfly -e "INSERT INTO
> oncs.tblSessionRequest (MACAddress, IPAddress) VALUES('$2', '$3
>    ');" &> /home/shared/dhcpconnect.log
hmm...
You mean:
&>>/home
???
> echo "Done - database log" >> /home/shared/dhcpconnect.log
>
> # Now we start the data accounting bit using IP tables...
> # Make sure the iptables rules exist!  This should return errors because
> these rules should always already exist.
> iptables -N traffic_in  >> /home/shared/dhcpconnect.log
> iptables -N traffic_out  >> /home/shared/dhcpconnect.log
>
> echo $nowdate, $2, $3 >> /home/shared/dhcpconnect.log
>
> echo "Done - rule create" >> /home/shared/dhcpconnect.log
>
> # Create Rule for IP to count the data.
> iptables -A traffic_in -d $3  >> /home/shared/dhcpconnect.log
> iptables -A traffic_out -s $3  >> /home/shared/dhcpconnect.log
>
> echo "Done - counter add" >> /home/shared/dhcpconnect.log
>
> #add chains as target to FORWARD rule - after the first time, this
> should always be already done.
> iptables -I FORWARD 1 -j traffic_in  >> /home/shared/dhcpconnect.log
> iptables -I FORWARD 2 -j traffic_out  >> /home/shared/dhcpconnect.log
>
>
> echo "Done forward rule add" >> /home/shared/dhcpconnect.log
>
> echo "Done", $2, $3  >> /home/shared/dhcpconnect.log
>
What is in dhcpconnect.log ??? :)
Could you post it? :)

Swifty

Re: IPTables script problem...

[Don Gould]

Thanks :)

With help from a few others I found the answer...

you need sudo to do this.

See:  www.tcn.bowenvale.co.nz - my web site, if you're interested in 
following the progress.

What I'm working on will be gpl

Cheers Don

Gáspár Lajos wrote:
> Don Gould írta:
>> Can anyone tell me why this isn't working?
>>
> ...
>>
>> [root@bowenvale shared]# cat dhcp.src
>> #!/bin/sh
> For debug try this:
> 
> #!/bin/bash -x
> 
>> nowdate=$(date)
>> # echo $nowdate, $0, $1, $2, $3 >> /home/shared/dhcpconnect.log
>>
>> echo $nowdate, $2, $3 >> /home/shared/dhcpconnect.log
>>
>> echo "Start" >> /home/shared/dhcpconnect.log
>>
>> mysql -h bowenvale -u oncs -pbutterfly -e "INSERT INTO
>> oncs.tblSessionRequest (MACAddress, IPAddress) VALUES('$2', '$3
>>    ');" &> /home/shared/dhcpconnect.log
> hmm...
> You mean:
> &>>/home
> ???
>> echo "Done - database log" >> /home/shared/dhcpconnect.log
>>
>> # Now we start the data accounting bit using IP tables...
>> # Make sure the iptables rules exist!  This should return errors because
>> these rules should always already exist.
>> iptables -N traffic_in  >> /home/shared/dhcpconnect.log
>> iptables -N traffic_out  >> /home/shared/dhcpconnect.log
>>
>> echo $nowdate, $2, $3 >> /home/shared/dhcpconnect.log
>>
>> echo "Done - rule create" >> /home/shared/dhcpconnect.log
>>
>> # Create Rule for IP to count the data.
>> iptables -A traffic_in -d $3  >> /home/shared/dhcpconnect.log
>> iptables -A traffic_out -s $3  >> /home/shared/dhcpconnect.log
>>
>> echo "Done - counter add" >> /home/shared/dhcpconnect.log
>>
>> #add chains as target to FORWARD rule - after the first time, this
>> should always be already done.
>> iptables -I FORWARD 1 -j traffic_in  >> /home/shared/dhcpconnect.log
>> iptables -I FORWARD 2 -j traffic_out  >> /home/shared/dhcpconnect.log
>>
>>
>> echo "Done forward rule add" >> /home/shared/dhcpconnect.log
>>
>> echo "Done", $2, $3  >> /home/shared/dhcpconnect.log
>>
> What is in dhcpconnect.log ??? :)
> Could you post it? :)
> 
> Swifty

-- 
Don Gould
www.thinkdesignprint.co.nz - www.tcn.bowenvale.co.nz - 
www.bowenvale.co.nz - www.hearingbooks.co.nz - www.buxtonsquare.co.nz - 
SkypeMe:  ThinkDesignPrint - Good ideas:  www.solarking.co.nz