Hi
I'm trying to get traffic statistics from conntrack which matched with
iptables rules.
I'm using this method.
echo -e "0 Rule0\n1 Rule1" > /etc/xtables/connlabel.conf
iptables -t filter -N Rule0
iptables -t filter -N Rule1
iptables -t filter -A Rule0 -m connlabel --set --label Rule0
iptables -t filter -A Rule0 -j LOG --log-prefix "Rule0 ACCEPT "
iptables -t filter -A Rule0 -j ACCEPT
iptables -t filter -A Rule1 -m connlabel --set --label Rule1
iptables -t filter -A Rule1 -j LOG --log-prefix "Rule1 ACCEPT "
iptables -t filter -A Rule1 -j ACCEPT
iptables -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -m state --state NEW -m set --match-set
Rule0_src src -j Rule0
iptables -t filter -A FORWARD -m state --state NEW -m set --match-set
Rule1_src src -j Rule1
Conntrack event looking like this.
ipv4 2 tcp 6 432000 ESTABLISHED src=10.200.200.1
dst=10.200.200.21 sport=41090 dport=22 packets=202 bytes=16085
src=10.200.200.21 dst=10.200.200.1 sport=22 dport=41090 packets=148
bytes=20737 [ASSURED] mark=0 delta-time=62 [start=Thu Apr 23 11:58:23
2020] use=1 id=2928336586 labels=Rule0
I have some issues my setup.
1- Conntrack couldn't pass label information when event state is
DESTROY. I need this. ( iptables v1.6.1, conntrack v1.4.4)
2- Connlabel limit is 127 in kernel "xt_connlabel.h" header file. This
is so limited for my design. If I increase this value in kernel what is
the effect?
Is this method good design or are there any other suggestion?
Thank you.
--
Fatih USTA
