L7-filter nerozlisuje pakety

Cau, L7-filter nerozlisuje pakety, problem je, ze se v iptables vsechny markujou jako unknown.

Nastaveni iptables:

-A POSTROUTING -d 192.168.2.34 -m layer7 --l7proto ftp -j MARK --set-mark 3
-A POSTROUTING -m mark --mark 3 -j CONNMARK --save-mark
-A POSTROUTING -d 192.168.2.34 -m layer7 --l7proto http -j MARK --set-mark 5
-A POSTROUTING -d 192.168.2.34 -m layer7 --l7proto unknown -j MARK --set-mark 4

Nastaveni HTBinit

eth1
default=0

eth1-2.root
RATE=128Kbit

eth1-2:10.2_34www
RATE=1Kbit
CEIL=128Kbit
LEAF=sfq
MARK=5
PRIO=1

eth1-2:20.2_34ftp
RATE=1Kbit
CEIL=64Kbit
LEAF=sfq
MARK=3
PRIO=1

eth1-2:30.2_34unknown
RATE=1Kbit
CEIL=10Kbit
LEAF=sfq
MARK=4
PRIO=2

Takto je vsechen provoz i ftp a http omezen na 10Kbit. Http by pritom mel byt max. 128 a ftp max 64Kbps.

Dotaz: L7-filter nerozlisuje pakety

Odpovědi