conntrack traffic statistics and connlabel

conntrack traffic statistics and connlabel

[Fatih USTA]

Hi
I'm trying to get traffic statistics from conntrack which matched with 
iptables rules.


I'm using this method.

echo -e "0 Rule0\n1 Rule1" > /etc/xtables/connlabel.conf

iptables -t filter -N Rule0
iptables -t filter -N Rule1

iptables -t filter -A Rule0 -m connlabel --set --label Rule0
iptables -t filter -A Rule0 -j LOG --log-prefix "Rule0 ACCEPT "
iptables -t filter -A Rule0 -j ACCEPT

iptables -t filter -A Rule1 -m connlabel --set --label Rule1
iptables -t filter -A Rule1 -j LOG --log-prefix "Rule1 ACCEPT "
iptables -t filter -A Rule1 -j ACCEPT

iptables -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -t filter -A FORWARD -m state --state NEW -m set --match-set 
Rule0_src src -j Rule0
iptables -t filter -A FORWARD -m state --state NEW -m set --match-set 
Rule1_src src -j Rule1

Conntrack event looking like this.

ipv4     2 tcp      6 432000 ESTABLISHED src=10.200.200.1 
dst=10.200.200.21 sport=41090 dport=22 packets=202 bytes=16085 
src=10.200.200.21 dst=10.200.200.1 sport=22 dport=41090 packets=148 
bytes=20737 [ASSURED] mark=0 delta-time=62 [start=Thu Apr 23 11:58:23 
2020] use=1 id=2928336586 labels=Rule0


I have some issues my setup.
1- Conntrack couldn't pass label information when event state is 
DESTROY. I need this. ( iptables v1.6.1, conntrack v1.4.4)
2- Connlabel limit is 127 in kernel "xt_connlabel.h" header file. This 
is so limited for my design. If I increase this value in kernel what is 
the effect?

Is this method good design or are there any other suggestion?

Thank you.

-- 
Fatih USTA