From 2c10a936f5cf37d6d016fda26db0b96712f041d3 Mon Sep 17 00:00:00 2001 From: teastep Date: Fri, 21 Mar 2008 02:35:56 +0000 Subject: [PATCH] More tcfilter documentation git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8320 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- docs/traffic_shaping.xml | 105 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) diff --git a/docs/traffic_shaping.xml b/docs/traffic_shaping.xml index 99b5e28b1..2ec35cc17 100644 --- a/docs/traffic_shaping.xml +++ b/docs/traffic_shaping.xml @@ -1334,6 +1334,111 @@ qt ip link set dev ifb0 up 2:110 - 206.124.146.179 #SNAT Responses 2:110 - 206.124.146.180 #Work Laptop 2:130 - 206.124.146.177 tcp 25 #Incoming Email. + + You can examine the installed filters with the shorewall + show filters command. What follows shows the output for + eth0 with the filters shown + above. Bold font are comments + explaining the rules.gateway:~ # shorewall-lite show filters +Shorewall Lite 4.1.6 Clasifiers at gateway - Thu Mar 20 16:38:10 PDT 2008 + +Device eth1: + +Device eth2: + +Device eth0: +filter parent 1: protocol ip pref 10 u32 +filter parent 1: protocol ip pref 10 u32 fh 2: ht divisor 1 <========= Start of table 2. parses TCP header + +filter parent 1: protocol ip pref 10 u32 fh 2::800 order 2048 key ht 2 bkt 0 flowid 1:130 (rule hit 2268 success 0) + match c1210000/ffff0000 at nexthdr+0 (success 0 ) <========= SOURCE PORT 49441 goes to class 1:130 + +filter parent 1: protocol ip pref 10 u32 fh 2::801 order 2049 key ht 2 bkt 0 flowid 1:130 (rule hit 2268 success 546) + match 03690000/ffff0000 at nexthdr+0 (success 546 ) <========= SOURCE PORT 873 goes to class 1:130 + +filter parent 1: protocol ip pref 10 u32 fh 1: ht divisor 1 <========= Start of table 1. parses ICMP header + +filter parent 1: protocol ip pref 10 u32 fh 1::800 order 2048 key ht 1 bkt 0 flowid 1:110 (rule hit 16 success 10) + match 08000000/ff000000 at nexthdr+0 (success 10 ) <========= echo-request goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 1::801 order 2049 key ht 1 bkt 0 flowid 1:110 (rule hit 6 success 6) + match 00000000/ff000000 at nexthdr+0 (success 6 ) <========= echo-reply goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 800: ht divisor 1 <========= Start of Table 800. Packets start here! + + =============== The following 2 rules are generated by the class definition in /etc/shorewall/classes ================== + +filter parent 1: protocol ip pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:110 (rule hit 19434 success 1686) + match 00060000/00ff0000 at 8 (success 5359 ) <========= TCP + match 05000000/0f00ffc0 at 0 (success 2867 ) <========= Header length 20 and Packet Length < 64 + match 00100000/00ff0000 at 32 (success 1686 ) <========= ACK + +filter parent 1: protocol ip pref 10 u32 fh 800::801 order 2049 key ht 800 bkt 0 flowid 1:110 (rule hit 17748 success 16) + match 00100000/00100000 at 0 (success 16 ) <========= Minimize-delay jumps to class 1:110 + + =============== Jump to Table 2 if the matches are met ================== + +filter parent 1: protocol ip pref 10 u32 fh 800::807 order 2055 key ht 800 bkt 0 link 2: (rule hit 5853 success 0) + match ce7c92b2/ffffffff at 12 (success 0 ) <========= SOURCE 206.124.146.178 + match 00060000/00ff0000 at 8 (success 0 ) <========= PROTO TCP + offset 0f00>>6 at 0 eat +filter parent 1: protocol ip pref 10 u32 fh 800::802 order 2050 key ht 800 bkt 0 flowid 1:110 (rule hit 17732 success 3800) + match ce7c92b2/ffffffff at 12 (success 3800 ) <========= SOURCE 206.124.146.178 goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 800::803 order 2051 key ht 800 bkt 0 flowid 1:110 (rule hit 13932 success 1058) + match ce7c92b3/ffffffff at 12 (success 1058 ) <========= SOURCE 206.124.146.179 goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 800::804 order 2052 key ht 800 bkt 0 flowid 1:110 (rule hit 12874 success 7005) + match ce7c92b4/ffffffff at 12 (success 7005 ) <========= SOURCE 206.124.146.180 goes to class 1:110 + +filter parent 1: protocol ip pref 10 u32 fh 800::805 order 2053 key ht 800 bkt 0 link 1: (rule hit 5869 success 0) + match 00010000/00ff0000 at 8 (success 16 ) <========= PROTO ICMP jumps to Table 1 + offset 0f00>>6 at 0 eat + +filter parent 1: protocol ip pref 10 u32 fh 800::806 order 2054 key ht 800 bkt 0 link 1: (rule hit 5853 success 0) + match 00010000/00ff0000 at 8 (success 0 ) <========= PROTO ICMP jumps to Table 1 (Shorewall-perl isn't + offset 0f00>>6 at 0 eat smart enough yet to suppress this duplicate rule) + + =============== Jump to Table 2 if the matches are met ================== + +filter parent 1: protocol ip pref 10 u32 fh 800::808 order 2056 key ht 800 bkt 0 link 2: (rule hit 5853 success 0) + match ce7c92b1/ffffffff at 12 (success 5654 ) <========= SOURCE 206.124.146.177 + match 00060000/00ff0000 at 8 (success 2268 ) <========= PROTO TCP + offset 0f00>>6 at 0 eat