ii95m n00b

Joined: 04 Aug 2004 Posts: 1
|
Posted: Wed Aug 04, 2004 12:44 pm Post subject: htb + tc + iptables strange problems |
|
|
Dear all,
In my machines, there are two interfaces (eth0 for internal, eth1 for internet), the machine is running masquerade.
I'm using kernel 2.6.6 love 4, iptables-1.2.9-r4 (compiled with extensions), iproute2 [2.6.7.20040608].
I've tried using kernel 2.6.7 (development gentoo)
The problem I'm having is like this:
if I make an iptables rules only using dport or sport, mark it with a marker, the htb works fine.
the problems occur only when I add source ip address, destination port, PREROUTING, INPUT, FORWARD rule, then the htb catches none of the mark, it goes to default class of htb.
here's my htb config:
#!/bin/bash
tc qdisc del dev eth1 root
tc qdisc add dev eth1 root handle 1: htb default 80 debug 3333333
tc class add dev eth1 parent 1: classid 1:1 htb rate 65kbit ceil 65kbit
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 20kbit ceil 65kbit prio 3
tc class add dev eth1 parent 1:1 classid 1:20 htb rate 5kbit ceil 10kbit prio 0
tc class add dev eth1 parent 1:1 classid 1:30 htb rate 8kbit ceil 11kbit prio 2
tc class add dev eth1 parent 1:1 classid 1:40 htb rate 23kbit ceil 23kbit prio 1
tc class add dev eth1 parent 1:1 classid 1:80 htb rate 8kbit ceil 10kbit prio 4
tc qdisc add dev eth1 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev eth1 parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev eth1 parent 1:30 handle 30: sfq perturb 10
tc qdisc add dev eth1 parent 1:40 handle 40: sfq perturb 10
tc qdisc add dev eth1 parent 1:80 handle 80: sfq perturb 10
tc filter add dev eth1 parent 1:0 protocol ip handle 1 fw flowid 1:10
tc filter add dev eth1 parent 1:0 protocol ip handle 2 fw flowid 1:20
tc filter add dev eth1 protocol ip parent 1:0 handle 3 fw flowid 1:30
tc filter add dev eth1 parent 1:0 protocol ip handle 4 fw flowid 1:40
tc filter add dev eth1 protocol ip parent 1:0 handle 80 fw flowid 1:80
Here's my iptables:
-A PREROUTING -p tcp -m tcp --sport 3128 -j MARK --set-mark 0x2
-A PREROUTING -p tcp -m tcp --dport http -j MARK --set-mark 0x2
-A PREROUTING -p tcp -m tcp --dport https -j MARK --set-mark 0x2
-A PREROUTING -p tcp -m tcp --dport 53 -j MARK --set-mark 0x1
-A PREROUTING -p udp -m udp --dport 53 -j MARK --set-mark 0x1
-A PREROUTING -p tcp -m multiport --dports 110,25 -j MARK --set-mark 0x3
-A PREROUTING -p udp -m udp --dport 123 -j MARK --set-mark 0x4
-A PREROUTING -p udp -m udp --dport domain -j MARK --set-mark 0x1
-A OUTPUT -p tcp -m tcp --sport 3128 --destination 192.168.1.145 -j MARK --set-mark 0x4
here's the output of iptables -L -v -x -t mangle
Chain PREROUTING (policy ACCEPT 2146 packets, 1400756 bytes)
pkts bytes target prot opt in out source destination
0 0 MARK tcp -- any any anywhere anywhere tcp spt:webcache MARK set 0x2
1 52 MARK tcp -- any any anywhere anywhere tcp dpt:www MARK set 0x2
0 0 MARK tcp -- any any anywhere anywhere tcp dpt:https MARK set 0x2
0 0 MARK tcp -- any any anywhere anywhere tcp dpt:domain MARK set 0x1
0 0 MARK udp -- any any anywhere anywhere udp dpt:domain MARK set 0x1
254 356576 MARK tcp -- any any anywhere anywhere multiport dports pop3,smtp MARK set 0x3
0 0 MARK tcp -- any any anywhere anywhere tcp dpt:5050 MARK set 0x4
0 0 MARK udp -- any any anywhere anywhere udp dpt:domain MARK set 0x1
Chain INPUT (policy ACCEPT 2105 packets, 1395019 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 2 packets, 315 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1985 packets, 362575 bytes)
pkts bytes target prot opt in out source destination
1 1500 MARK tcp -- any any anywhere 192.168.1.145 tcp spt:webcache MARK set 0x4
Chain POSTROUTING (policy ACCEPT 1987 packets, 362890 bytes)
pkts bytes target prot opt in out source destination
here's the output of tc -s -d class show dev eth1
class htb 1:40 parent 1:1 leaf 40: prio 1 quantum 1000 rate 23Kbit ceil 23Kbit burst 1628b/8 mpu 0b cburst 1628b/8 mpu 0b level 0
Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
lended: 0 borrowed: 0 giants: 0
tokens: 566607 ctokens: 566607
class htb 1:80 parent 1:1 leaf 80: prio 4 quantum 1000 rate 8Kbit ceil 10Kbit burst 1609b/8 mpu 0b cburst 1611b/8 mpu 0b level 0
Sent 13428 bytes 175 pkts (dropped 0, overlimits 0)
rate 296bps 4pps
lended: 175 borrowed: 0 giants: 0
tokens: -1608354 ctokens: -172416
notice the class htb 1:40 doesn't have packet lended.
Please help me , and pardon my english.
has anyone experience this? |
|