Linux-Bulgaria.ORG
навигация

 

начало

пощенски списък

архив на групата

семинари ...

документи

как да ...

 

 

Предишно писмо Следващо писмо Предишно по тема Следващо по тема По Дата По тема (thread)

Re: lug-bg: iptables accounting


  • Subject: Re: lug-bg: iptables accounting
  • From: Velin Getov <vgetov@xxxxxx>
  • Date: Tue, 06 Jan 2004 15:03:58 +0200

Tosho Yankov wrote:
Zdravejite,
imam malyk problem v tochnostta na otchitane na accountinga si.
Eto q shemata
porxy i acconting na edna i systa mashina, real IP-ta za vsichki
usres. Do kato bqh vse oste s ipchains vischko beshe nared. Zakachah
broqchite na input i output verigata i vsichko si se broeshe ok. Sled
kato minah na iptables eto kakvo poluchih:

borqchite zakacheni na INPUT i OUTPUT verigite:
- broi se samo proxy trafika (bez vsichko ostanalo)

Suvsem normalno, stom proxy-to ti e na sustata machina. INPUT i OPTPUT verigite ne otchitat tranzitnia trafik, t.e. tova koeto minava prez verigata FORWARD ne se broi na INPUT i OUTPUT.


broqcha zakachen samo na FORWARD verigata
- broi se vsichko BEZ proxy trafika

Suvsem estestveno, spored gorekazanoto.

broqcha zakachen kakto sledva
 - vhodqst - INPUT + FORWARD (tuk ne sym sigruen dali ne trqbva da mu
 kaja vyv forwarda -s moita_mreja/moita_maska
 - izhodqst - OUTPUT + FORWARD (otnovo dali trqbva da se okaje -d
 moita_mreja/moita_maska)

Kogato sumirash vhodiastia trafik zadai vhodiastia interface. Naprimer ako eth0 ti e kum internet

rule A
#iptables -I FORWARD -i eth0

Tova ti dava vsichko koeto e vhoidiast trafik ot internet kum tvoiata machina. Analogichno izhodiastia trafik ti e :

rule B
#iptables -I FORWARD -o eth0


 ta taka tova v skobite poneje ne sym siguren i sa bes source i
 destination i imam otichtane na trafik v poveche ot kolkoto e
 deistvitelniq.

sled tova pravish kalkulaciata:
vhodiast= INPUT+"rule A"
izhodiast=OUTPUT+"rule B"

 Imam nujda ot pomost kak tochno trqbva da podredq verigite.
 Blagodarq Vi predvaritelno.

Dano sum te razbral pravilno....
Uspeh!

 P.S. Resheniq ot tipa na ipac-ng i kakvito i da e dopulnitelni
 softwares ne mi vyrshat rabota, prosto imam mnogo navyrzani scriptove
 koito vyrshat razni zadachi i iskam da imam vhodqst i izhodqt broqch,
 a az ot tam veche znam kakvo da si gi pravq :)



--
Velin Getov
JDC, Telecomputer BG

--

Java Development Center, IIS Ltd.
G.M. Dimitrov blvd. bl.60 apt.79
Sofia, BG-1172

email:  vGetov@xxxxxx
phone:  +359(0)2-962-5581
fax:    +359(0)2-720-531
------------------------------

============================================================================
A mail-list of Linux Users Group - Bulgaria (bulgarian linuxers).
http://www.linux-bulgaria.org - Hosted by Internet Group Ltd. - Stara Zagora
To unsubscribe: http://www.linux-bulgaria.org/public/mail_list.html
============================================================================



 

наши приятели

 

линукс за българи
http://linux-bg.org

FSA-BG
http://fsa-bg.org

OpenFest
http://openfest.org

FreeBSD BG
http://bg-freebsd.org

KDE-BG
http://kde.fsa-bg.org/

Gnome-BG
http://gnome.cult.bg/

проект OpenFMI
http://openfmi.net

NetField Forum
http://netField.ludost.net/forum/

 

 

Linux-Bulgaria.ORG

Mailing list messages are © Copyright their authors.