Keep in mind that TC only controls traffic that is outbound from a system. If you are wanting to TC traffic coming in to your system you will need to look at something like IMQ. IMQ as I understand it is like a virtual device that traffic comes in to and is then resend out of back in to your system as it normally would be with out IMQ in the mix. The reason that you would want to do this is so that you can assign TC rules to the IMQ to control what does come in on the standard interfaces on your system.
With that in mind your TC rule matching for 8099 coming in will never match b/c you are redirecting it to 8080 before it would be leaving the system where the TC rule is looking for it. At least that's the way that I understand what you have written. :s
Grant. . . .
Grames Gernot wrote:
Hi,
My problem is following now:
I would like to set the filters for port 8099. I have tried it, but nothing happened.
When I try the same filter for the port 8080 it is working very well.
.) working filter (here I can see the dropped packages):
tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8080 0xffff police rate 1kbit burst 1 drop flowid :1
.) not working filter (here I can`t see the dropped packages):
tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8099 0xffff police rate 1kbit burst 1 drop flowid :1
Maybe it is a problem of the port forwarding, because I have set the forwarding of the incoming traffic on 8099 to port 8080.
iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere iacapp3.local tcp dpt:8099 to:192.168.0.10:8080
Chain POSTROUTING (policy ACCEPT) target prot opt source destination
Chain OUTPUT (policy ACCEPT) target prot opt source destination
So my goal is to restrict incoming access only to port 8099 an not 8080 (where the filters work)!
Gernot
_______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
