On Friday 09 July 2004 13:10, FB wrote: > Hello there! > > I am trying to get traffic shaping working on my Linux router (debian > woody 3r02) and for some things I wanted to use the layer 7 packet > classifier, but I can't get it to work. > Here is what I did: > > -downloaded the patches from http://l7-filter.sourceforge.net > -downloaded the kernel 2.6.7 source > -downloaded the iptables 1.2.11 source That's not necessary. You might be creating more work for yourself. I just recycled the Debian iptables package, which is still 1.2.9 I believe. You'll need to patch it and create the appropriate dot file for the build to succeed, but after that I just rebuild the package with 'debuild -uc -us' and copied it to my compiler-less router. I'm using 2.6.6, but I'm sure 2.6.7 should work fine. > -patched kernel (layer7 patch and some patch to get iptables 1.2.11 > working with kernel 2.6.7) > -patched iptables > -compiled iptables > -activated layer 7 support in kernel-config (and a lot of other packet > classifing options) > -compiled and installed kernel > > Now I tried to mark some packets with layer 7 so that I can shape them > with tc afterwards. But nothing changed, outgoing connection still > didn't changed. So I changed the line in the iptables-script to this: > > $IPTABLES -t filter -A OUTPUT -m layer7 --l7dir /etc/l7-protocols > --l7proto ftp -j DROP I believe the documentation mentions that layer7 works best when it can see both 'sides' of the connection. If you're filtering through INPUT or OUTPUT you're missing half. Check the ftp protocol match. Does it rely on seeing both sides of the connection to match up? Try matching in FORWARD, PREROUTING, or POSTROUTING. I believe these see all sides of the connection. >From docs[1]: "Some patterns need to be able to observe both sides of a connection in order to match. This is pretty easy to achieve with Netfilter. By default, rules in the POSTROUTING chain of the mangle table will apply to both directions. However, the OUTPUT chain (for example) only sees locally generated packets, so it's not a good choice." [1] http://l7-filter.sourceforge.net/L7-HOWTO-Netfilter _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
