Hi,
My problem is following now:
I would like to set the filters for port 8099. I have tried it, but nothing happened.
When I try the same filter for the port 8080 it is working very well.
.) working filter (here I can see the dropped packages): tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8080 0xffff police rate 1kbit burst 1 drop flowid :1 .) not working filter (here I can`t see the dropped packages): tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8099 0xffff police rate 1kbit burst 1 drop flowid :1
Maybe it is a problem of the port forwarding, because I have set the
forwarding of the incoming traffic on 8099 to port 8080.
iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere iacapp3.local tcp dpt:8099
to:192.168.0.10:8080
It looks like you are using the old policer that is after PREROUTING then -
I guess you don't see any drops on 8099 because you already DNATed it to 8080.
So my goal is to restrict incoming access only to port 8099 an not 8080 (where the filters work)!
If you drop 8099 then your DNAT rule won't ever match - or are you thinking of multiple interfaces?
To get policer before PREROUTING you need to recompile with different kernel options - You should be able to do the same with just IPTABLES rules specifying interface etc.
Andy. _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
