Hi,
31997506400-31997506128=272
You are under the quota!
Maybe you had just bigger packets than 272 bytes...
Swifty
2012-03-09 01:19 keltezéssel, James Anderson írta:
Hello everyone.
I have been trying to get iptables to stop traffic to the internet
after I have exceeded 29.8 GB and just allow traffic to the local
subnet after that. I did the conversion on google and apparently
29.8GB is 31997506400 bytes. However tonight when I got home and did
iptables -L -v, I saw this:
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
28M 32G ACCEPT all -- any any anywhere
!192.168.2.0/24 quota: 31997506400 bytes
2459K 3621M ACCEPT all -- any any anywhere
192.168.2.0/24
5770 1151K REJECT all -- any any anywhere
anywhere reject-with icmp-port-unreachable
At first I thought the quota didn't work, but then I did iptables-save -c
*filter
:INPUT ACCEPT [23078834:14787771556]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
[28216466:31997506128] -A OUTPUT ! -d 192.168.2.0/24 -m quota --quota
31997506400 -j ACCEPT
[2475569:3622559686] -A OUTPUT -d 192.168.2.0/24 -j ACCEPT
[24154:2350411] -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
COMMIT
which shows that it stopped at 29.7999998 GB.
Could someone perhaps explain the discrepancy?
Does iptables keep counting bytes even after the quota is full?
many thanks in advance,
James
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
