On Fri, 9 Sep 2011, Jean-Philippe Menil wrote: > Le 09/09/2011 11:22, Jozsef Kadlecsik a écrit : > > On Fri, 9 Sep 2011, Jean-Philippe Menil wrote: > > > > > Le 09/09/2011 11:12, Jozsef Kadlecsik a écrit : > > > > On Fri, 9 Sep 2011, Jean-Philippe Menil wrote: > > > > > > > > > I try to limit the connection per ip with connlimit in addition to the > > > > > socket > > > > > match, with the following rule: > > > > > $IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --syn --dport http -m > > > > > socket > > > > > -m connlimit --connlimit-above 0 -j DIVERT > > > > > > > > > > But as you can see, theses rules never match: > > > > > > > > > > 0 0 DIVERT tcp -- * * 192.168.100.0/24 > > > > > 0.0.0.0/0 > > > > > tcp dpt:80flags: 0x17/0x02 socket #conn src/32> 1 > > > > > 9 3030 DIVERT tcp -- * * 192.168.100.0/24 > > > > > 0.0.0.0/0 > > > > > tcp dpt:80 socket > > > > > 5 216 TPROXY tcp -- * * 192.168.100.0/24 > > > > > 0.0.0.0/0 > > > > > tcp dpt:80 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 > > > > > 0 0 DIVERT tcp -- * * 192.168.100.0/24 > > > > > 0.0.0.0/0 > > > > > tcp dpt:3128flags: 0x17/0x02 socket #conn src/32> 1 > > > > > 6 2491 DIVERT tcp -- * * 192.168.100.0/24 > > > > > 0.0.0.0/0 > > > > > tcp dpt:3128 socket > > > > > 19 800 TPROXY tcp -- * * 192.168.100.0/24 > > > > > 0.0.0.0/0 > > > > > tcp dpt:3128 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 > > > > > > > > > > Is this an expected behaviour, or a problem in my rules? > > > > You use the socket match from the PREROUTING chain, where it'll never > > > > match: it's before routing, so the the system could not associate the > > > > packet to a socket yet. > > > > > > > Ok, i see. > > > So, if my understand is correct, it will be better to do like this: > > > > > > $IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --dport http -m socket -j > > ^^^^^^^^^^ ^^^^^^^^^ > > Here again.... > > > No, it's working as expected. > I have just followed the documentation in: > Documentation/networking/tproxy.txt OK, the socket match not only checks but lookups the matching sockets. So it does indeed work from the PREROUTING chain. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary
