diff --git a/docs/traffic_shaping.xml b/docs/traffic_shaping.xml index 2ec35cc17..da96bf09d 100644 --- a/docs/traffic_shaping.xml +++ b/docs/traffic_shaping.xml @@ -1179,10 +1179,6 @@ ip link set ifb0 up ipsets are not supported - - port lists are not supported - - port ranges are not supported @@ -1278,11 +1274,12 @@ eth0 192.168.1.0/24 206.124.146.179 - DEST PORT + DEST PORT(S) - Destination port name or number. May only be specified if - the protocol is TCP, UDP, SCTP or ICMP. + Comma-separated list of destination port names or numbers. + May only be specified if the protocol is TCP, UDP, SCTP or + ICMP. @@ -1290,8 +1287,8 @@ eth0 192.168.1.0/24 206.124.146.179 SOURCE PORT - Source port name or number. May only be specified if the - protocol is TCP, UDP or SCTP. + Comma-separated list of source port names or numbers. May + only be specified if the protocol is TCP, UDP or SCTP. @@ -1316,17 +1313,17 @@ qt ip link set dev ifb0 up 2:110 - 5*full/10 full 1 tcp-ack,tos-minimize-delay 2:120 - 2*full/10 6*full/10 2 default 2:130 - 2*full/10 6*full/10 3/etc/shorewall/tcfilters:#INTERFACE: SOURCE DEST PROTO DEST SOURCE -#CLASS PORT PORT +#CLASS PORT(S) PORT(S) # # OUTGOING TRAFFIC # -1:130 206.124.146.178 - tcp - 49441 #BITTORRENT on wookie -1:110 206.124.146.178 #wookie -1:110 206.124.146.179 #SNAT of internal systems -1:110 206.124.146.180 #Work Laptop -1:110 - - icmp echo-request +1:130 206.124.146.178 - tcp - 49441,49442 #BITTORRENT on wookie +1:110 206.124.146.178 #wookie +1:110 206.124.146.179 #SNAT of internal systems +1:110 206.124.146.180 #Work Laptop +1:110 - - icmp echo-request,echo-reply 1:110 - - icmp echo-reply -1:130 206.124.146.177 - tcp - 873 # +1:130 206.124.146.177 - tcp - 873,25 #Bulk Traffic # # INCOMING TRAFFIC # @@ -1339,106 +1336,111 @@ qt ip link set dev ifb0 up show filters command. What follows shows the output for eth0 with the filters shown above. Bold font are comments - explaining the rules.gateway:~ # shorewall-lite show filters -Shorewall Lite 4.1.6 Clasifiers at gateway - Thu Mar 20 16:38:10 PDT 2008 + explaining the rules.gateway:~ # shorewall-lite show filters +Shorewall Lite 4.1.6 Clasifiers at gateway - Fri Mar 21 08:06:47 PDT 2008 Device eth1: Device eth2: Device eth0: -filter parent 1: protocol ip pref 10 u32 +filter parent 1: protocol ip pref 10 u32 +filter parent 1: protocol ip pref 10 u32 fh 3: ht divisor 1 <========= Start of table 3. parses TCP header + +filter parent 1: protocol ip pref 10 u32 fh 3::800 order 2048 key ht 3 bkt 0 flowid 1:130 (rule hit 102 success 0) + match 03690000/ffff0000 at nexthdr+0 (success 0 ) <========= SOURCE PORT 873 goes to class 1:130 + filter parent 1: protocol ip pref 10 u32 fh 2: ht divisor 1 <========= Start of table 2. parses TCP header - -filter parent 1: protocol ip pref 10 u32 fh 2::800 order 2048 key ht 2 bkt 0 flowid 1:130 (rule hit 2268 success 0) + role="bold"> <========= Start of table 2. parses ICMP header + +filter parent 1: protocol ip pref 10 u32 fh 2::800 order 2048 key ht 2 bkt 0 flowid 1:110 (rule hit 0 success 0) + match 08000000/ff000000 at nexthdr+0 (success 0 ) <========= ICMP Type 8 goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 2::801 order 2049 key ht 2 bkt 0 flowid 1:110 (rule hit 0 success 0) + match 00000000/ff000000 at nexthdr+0 (success 0 ) <========= ICMP Type 0 goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 1: ht divisor 1 <========= Start of table 1. parses TCP header + +filter parent 1: protocol ip pref 10 u32 fh 1::800 order 2048 key ht 1 bkt 0 flowid 1:130 (rule hit 0 success 0) match c1210000/ffff0000 at nexthdr+0 (success 0 ) <========= SOURCE PORT 49441 goes to class 1:130 -filter parent 1: protocol ip pref 10 u32 fh 2::801 order 2049 key ht 2 bkt 0 flowid 1:130 (rule hit 2268 success 546) - match 03690000/ffff0000 at nexthdr+0 (success 546 ) <========= SOURCE PORT 873 goes to class 1:130 +filter parent 1: protocol ip pref 10 u32 fh 1::801 order 2049 key ht 1 bkt 0 flowid 1:130 (rule hit 0 success 0) + match c1220000/ffff0000 at nexthdr+0 (success 0 ) <========= SOURCE PORT 49442 goes to class 1:130 -filter parent 1: protocol ip pref 10 u32 fh 1: ht divisor 1 <========= Start of table 1. parses ICMP header - -filter parent 1: protocol ip pref 10 u32 fh 1::800 order 2048 key ht 1 bkt 0 flowid 1:110 (rule hit 16 success 10) - match 08000000/ff000000 at nexthdr+0 (success 10 ) <========= echo-request goes to class 1:110 - -filter parent 1: protocol ip pref 10 u32 fh 1::801 order 2049 key ht 1 bkt 0 flowid 1:110 (rule hit 6 success 6) - match 00000000/ff000000 at nexthdr+0 (success 6 ) <========= echo-reply goes to class 1:110 - filter parent 1: protocol ip pref 10 u32 fh 800: ht divisor 1 <========= Start of Table 800. Packets start here! =============== The following 2 rules are generated by the class definition in /etc/shorewall/classes ================== -filter parent 1: protocol ip pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:110 (rule hit 19434 success 1686) - match 00060000/00ff0000 at 8 (success 5359 ) fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:110 (rule hit 2204 success 138) + match 00060000/00ff0000 at 8 (success 396 ) <========= TCP - match 05000000/0f00ffc0 at 0 (success 2867 ) <========= Header length 20 and Packet Length < 64 - match 00100000/00ff0000 at 32 (success 1686 ) <========= ACK -filter parent 1: protocol ip pref 10 u32 fh 800::801 order 2049 key ht 800 bkt 0 flowid 1:110 (rule hit 17748 success 16) - match 00100000/00100000 at 0 (success 16 ) fh 800::801 order 2049 key ht 800 bkt 0 flowid 1:110 (rule hit 2066 success 0) + match 00100000/00100000 at 0 (success 0 ) <========= Minimize-delay jumps to class 1:110 - =============== Jump to Table 2 if the matches are met ================== + =============== Jump to Table 1 if the matches are met ================== -filter parent 1: protocol ip pref 10 u32 fh 800::807 order 2055 key ht 800 bkt 0 link 2: (rule hit 5853 success 0) - match ce7c92b2/ffffffff at 12 (success 0 ) <========= SOURCE 206.124.146.178 - match 00060000/00ff0000 at 8 (success 0 ) fh 800::802 order 2050 key ht 800 bkt 0 link 1: (rule hit 2066 success 0) + match ce7c92b2/ffffffff at 12 (success 1039 ) <========= SOURCE 206.124.146.178 + match 00060000/00ff0000 at 8 (success 0 ) <========= PROTO TCP offset 0f00>>6 at 0 eat -filter parent 1: protocol ip pref 10 u32 fh 800::802 order 2050 key ht 800 bkt 0 flowid 1:110 (rule hit 17732 success 3800) - match ce7c92b2/ffffffff at 12 (success 3800 ) fh 800::803 order 2051 key ht 800 bkt 0 flowid 1:110 (rule hit 2066 success 1039) + match ce7c92b2/ffffffff at 12 (success 1039 ) <========= SOURCE 206.124.146.178 goes to class 1:110 -filter parent 1: protocol ip pref 10 u32 fh 800::803 order 2051 key ht 800 bkt 0 flowid 1:110 (rule hit 13932 success 1058) - match ce7c92b3/ffffffff at 12 (success 1058 ) <========= SOURCE 206.124.146.179 goes to class 1:110 +filter parent 1: protocol ip pref 10 u32 fh 800::804 order 2052 key ht 800 bkt 0 flowid 1:110 (rule hit 1027 success 132) + match ce7c92b3/ffffffff at 12 (success 132 ) <========= SOURCE 206.124.146.179 goes to class 1:110 -filter parent 1: protocol ip pref 10 u32 fh 800::804 order 2052 key ht 800 bkt 0 flowid 1:110 (rule hit 12874 success 7005) - match ce7c92b4/ffffffff at 12 (success 7005 ) fh 800::805 order 2053 key ht 800 bkt 0 flowid 1:110 (rule hit 895 success 603) + match ce7c92b4/ffffffff at 12 (success 603 ) <========= SOURCE 206.124.146.180 goes to class 1:110 -filter parent 1: protocol ip pref 10 u32 fh 800::805 order 2053 key ht 800 bkt 0 link 1: (rule hit 5869 success 0) - match 00010000/00ff0000 at 8 (success 16 ) <========= PROTO ICMP jumps to Table 1 - offset 0f00>>6 at 0 eat + =============== Jump to Table 2 if the matches are met ================== -filter parent 1: protocol ip pref 10 u32 fh 800::806 order 2054 key ht 800 bkt 0 link 1: (rule hit 5853 success 0) +filter parent 1: protocol ip pref 10 u32 fh 800::806 order 2054 key ht 800 bkt 0 link 2: (rule hit 292 success 0) match 00010000/00ff0000 at 8 (success 0 ) <========= PROTO ICMP jumps to Table 1 (Shorewall-perl isn't - offset 0f00>>6 at 0 eat smart enough yet to suppress this duplicate rule) + role="bold"><========= PROTO ICMP + offset 0f00>>6 at 0 eat - =============== Jump to Table 2 if the matches are met ================== - -filter parent 1: protocol ip pref 10 u32 fh 800::808 order 2056 key ht 800 bkt 0 link 2: (rule hit 5853 success 0) - match ce7c92b1/ffffffff at 12 (success 5654 ) =============== Jump to Table 3 if the matches are met ================== + +filter parent 1: protocol ip pref 10 u32 fh 800::807 order 2055 key ht 800 bkt 0 link 3: (rule hit 292 success 0) + match ce7c92b1/ffffffff at 12 (success 265 ) <========= SOURCE 206.124.146.177 - match 00060000/00ff0000 at 8 (success 2268 ) <========= PROTO TCP - offset 0f00>>6 at 0 eat + offset 0f00>>6 at 0 eat