I could not find any documentation on the significant of the weight assignment to multipath route, example if I have two nexthop, one is 2M and another is 512k, so the first nexthop should have a weight of 4 and the other is weight 1 ? Higher number meaning better bandwidth ? _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
Hi,> I could not find any documentation on the significant of > the weight assignment to multipath route, exampleIt is here: http://lartc.org/howto/lartc.rpdb.multiple-links.html#AEN298> if I have two nexthop, one is 2M and another is 512k, > so the first nexthop should have a weight of 4 and the > other is weight 1 ?If you want the traffic balanced equally per-speed, yes. It won''t be exact though.> Higher number meaning better bandwidth ?Yes, A higher weighting means a higher preference. regards, -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Damion de Soto - Software Engineer email: damion@snapgear.com SnapGear - A CyberGuard Company --- ph: +61 7 3435 2809 | Custom Embedded Solutions fax: +61 7 3891 3630 | and Security Appliances web: http://www.snapgear.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- Free Embedded Linux Distro at http://www.snapgear.org --- _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
I have two external IPs ( OUTSIDE_IP and OUTSIDE_IP2 ) and
I have already set them up using multipath routing and the outbound
nat traffic seems to be working fine, there is certain amount
of traffic split between the two external links.
But when checking the inbound port forwarding, only the port forwarding
on the first link is working, the in bound to the second is not working.
These are the port forwarding rules I make :-
For the first link :-
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 80 -j
DNAT --to ${SERVER}:80
iptables -A FORWARD -p tcp -d ${SERVER} --dport 801 -o ${INSIDE_DEVICE} -j
ACCEPT
For the second link, it is identical :-
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP2} --dport 80 -j
DNAT --to ${SERVER}:80
iptables -A FORWARD -p tcp -d ${SERVER} --dport 801 -o ${INSIDE_DEVICE} -j
ACCEPT
The second ''iptables -A FORWARD ...... '' is a repeat but it is
done anyway
( which I
believe should be no hard ).
A check on the ''iptables -n -L'' and ''iptables -t nat
-n -L'' revealed that
the setting were indeed exist.
Anything which i missed out which causes the inbound port forward only
working
on the first link but not on the second link ?
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
Hi all,
1 - I''m trying to use IPP2P v0.5, but it''s not working.... It
compiled with no errors, and i installed as described in the official web-page.
I set the rules but all the P2P traffic stays normal....
When i do the SAME proccess with IPP2P v0.4, the P2P traffic is correctly
blocked....
What''s happening?
2 - I''m do not need to block P2P traffic, just limit to a given rate.
But i''m having dificulties to create the appropriate rules and marks
(TC with HTB) in wondershaper. Can someone help me?
3 - Do IPP2P blocks/limits the IMESH network? I do know that the Soulseek
Network it''s not affected, but anyway... SLSK clients do consume the
entire bandwith if there are others clients are using too right?
My box:
Red Hat - 9
Kernel - 2.4.20-8
Iptables - 1.2.7a
Routing between 2 ethernet interfaces - eth0 is LAN and eth1 is WAN...
Thanks a lot,
LEANDRO TRAVAGLIA - BRAZIL
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.618 / Virus Database: 397 - Release Date: 9/3/2004
Hi, I had the same problem some time ago, I couldn''t have DNAT working onmy second interface. Could you please post all your routing tables? And also, what are your connections? Both PPP? PPPoE? ... Best Regards, Raphael Benedet 3D Artists - raph.com "bringing art into the third dimension" Ming-Ching Tiew wrote:> I have two external IPs ( OUTSIDE_IP and OUTSIDE_IP2 ) and > I have already set them up using multipath routing and the outbound > nat traffic seems to be working fine, there is certain amount > of traffic split between the two external links. > > But when checking the inbound port forwarding, only the port forwarding > on the first link is working, the in bound to the second is not working. > > These are the port forwarding rules I make :- > > For the first link :- > > iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 80 -j > DNAT --to ${SERVER}:80 > iptables -A FORWARD -p tcp -d ${SERVER} --dport 801 -o ${INSIDE_DEVICE} -j > ACCEPT > > For the second link, it is identical :- > > iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP2} --dport 80 -j > DNAT --to ${SERVER}:80 > iptables -A FORWARD -p tcp -d ${SERVER} --dport 801 -o ${INSIDE_DEVICE} -j > ACCEPT > > The second ''iptables -A FORWARD ...... '' is a repeat but it is done anyway > ( which I > believe should be no hard ). > > A check on the ''iptables -n -L'' and ''iptables -t nat -n -L'' revealed that > the setting were indeed exist. > > Anything which i missed out which causes the inbound port forward only > working > on the first link but not on the second link ? > > > > > > _______________________________________________ > LARTC mailing list / LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/ > >_______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
Hi,> 1 - I''m trying to use IPP2P v0.5, but it''s not working.... It compiled > with no errors, and i installed as described in the official web-page. I > set the rules but all the P2P traffic stays normal.... > When i do the SAME proccess with IPP2P v0.4, the P2P traffic is > correctly blocked....What version do you use? If it''s IPP2P 05 try the updated version 05b. If this does not help post your ruleset and an output of "iptables -L -n -v -x" for the appropriate table here please.> 2 - I''m do not need to block P2P traffic, just limit to a given rate. > But i''m having dificulties to create the appropriate rules and marks (TC > with HTB) in wondershaper. Can someone help me?I''ve never tried the wondershaper script myself but according to information from IPP2P users this shall work.> 3 - Do IPP2P blocks/limits the IMESH network? I do know that the > Soulseek Network it''s not affected, but anyway... SLSK clients do > consume the entire bandwith if there are others clients are using too > right?Well not yet - the supported p2p-networks are: -eDonkey -KaZaA -Gnutella -Direct Connect -BitTorrent (working well for me but still beta) -AppleJuice (still beta) If this feature is very important to you and if you are willing to do some testing for me I''ll take some time and try to implement these networks. I was going to do this anyway but not at the moment. Regards -- +++ NEU bei GMX und erstmalig in Deutschland: TÜV-geprüfter Virenschutz +++ 100% Virenerkennung nach Wildlist. Infos: http://www.gmx.net/virenschutz _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> Hi, > > I had the same problem some time ago, I couldn''t have DNAT working onmy > second interface. Could you please post all your routing tables? > And also, what are your connections? Both PPP? PPPoE? ... >OK, I am using Static IP for both links. Here is my routing table :- ( I use symbolic name here for easier reading .... ) # ip rule add from ${FIST_LINK_IP} table first # ip rule add from ${SECOND_LINK_IP} table second # ip route list table first FIRST_LINK_NET dev eth1 scope link LAN_LINK_NET dev eth0 scope link SECOND_LINK_NET dev eth2 scope link 127.0.0.0/8 dev lo scope link default via FIRST_LINK_GATEWAY dev eth1 # ip route list table second FIRST_LINK_NET dev eth1 scope link LAN_LINK_NET dev eth0 scope link SECOND_LINK_NET dev eth2 scope link 127.0.0.0/8 dev lo scope link default via SECOND_LINK_GATEWAY dev eth2 # ip route list FIRST_LINK_NET dev eth1 scope link src FIRST_LINK_IP SECOND_LINK_NET dev eth2 scope link src SECOND_LINK_IP LAN_LINK_NET dev eth0 proto kernel scope link src LAN_LINK_IP FIST_LINK_NET/24 dev eth1 proto kernel scope link src FIRST_LINK_IP SECOND_LINK_NET/24 dev eth2 proto kernel scope link src SECOND_LINK_IP default nexthop via FIRST_LINK_GATEWAY dev eth1 weight 4 nexthop via SECOND_LINK_GATEWAY dev eth2 weight 1 _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
Hello,
Hi,
#What version do you use? If it''s IPP2P 05 try the updated version 05b.
If
#this does not help post your ruleset and an output of "iptables -L -n -v
-x"
#for the appropriate table here please.
I''m tried to use v0.5b.... but it not worked. Now i''m using
v0.4 with no problems...
The rule i''m using...:
iptables -I FORWARD -p tcp -m ipp2p --ipp2p -j DROP
The command iptables -L -n -v -x returns:
Chain INPUT (policy ACCEPT 388 packets, 97441 bytes)
pkts bytes target prot opt in out source dest
ination
929 186369 RH-Lokkit-0-50-INPUT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain FORWARD (policy ACCEPT 10960 packets, 6220585 bytes)
pkts bytes target prot opt in out source
destination
317 36866 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 ipp2p v0.4 --ipp2p
21307 10219893 RH-Lokkit-0-50-INPUT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy ACCEPT 866 packets, 152845 bytes)
pkts bytes target prot opt in out source dest
ination
Chain RH-Lokkit-0-50-INPUT (2 references)
pkts bytes target prot opt in out source dest
ination
0 0 ACCEPT udp -- * * 200.150.13.244 0.0.0.
0/0 udp spt:53 dpts:1025:65535
0 0 ACCEPT udp -- * * 200.150.13.243 0.0.0.
0/0 udp spt:53 dpts:1025:65535
0 0 ACCEPT udp -- * * 200.150.4.5 0.0.0.
0/0 udp spt:53 dpts:1025:65535
31 5173 ACCEPT udp -- * * 200.150.4.4 0.0.0.
0/0 udp spt:53 dpts:1025:65535
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:80 flags:0x16/0x02
4 192 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:21 flags:0x16/0x02
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:22 flags:0x16/0x02
9 432 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:25 flags:0x16/0x02
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:23 flags:0x16/0x02
0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.
0/0 udp spts:67:68 dpts:67:68
81 26636 ACCEPT udp -- eth1 * 0.0.0.0/0 0.0.0.
0/0 udp spts:67:68 dpts:67:68
62 3100 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.
0/0
10654 4046161 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.
0/0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpts:0:1023 flags:0x16/0x02 reject-with icmp-port-unreachable
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:2049 flags:0x16/0x02 reject-with icmp-port-unreachable
47 6542 REJECT udp -- * * 0.0.0.0/0 0.0.0.
0/0 udp dpts:0:1023 reject-with icmp-port-unreachable
0 0 REJECT udp -- * * 0.0.0.0/0 0.0.0.
0/0 udp dpt:2049 reject-with icmp-port-unreachable
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpts:6000:6009 flags:0x16/0x02 reject-with icmp-port-unreachabl
e
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.
0/0 tcp dpt:7100 flags:0x16/0x02 reject-with icmp-port-unreachable
At this setup... everything goes fines. But if try to use v0.5b, nothing
happens...
I stop iptables
remove the ipt_ipp2p.o mod (v0.4)
configue the Makefile of the 0.5b version
install libipt_ipp2p.so - overwriting the old one
run insmod ipt_ipp2p.o successfully
set iptables -I FORWARD -p tcp -m ipp2p --ipp2p -j DROP
NOTHING HAPPENS - Kazaa can download files again....
#I''ve never tried the wondershaper script myself but according to
information
#from IPP2P users this shall work.
Do you use any kind of traffic shaper? What''s your configuration/rules?
#Well not yet - the supported p2p-networks are:
#-eDonkey
#-KaZaA
#-Gnutella
#-Direct Connect
#-BitTorrent (working well for me but still beta)
#-AppleJuice (still beta)
#
#If this feature is very important to you and if you are willing to do some
#testing for me I''ll take some time and try to implement these
networks. I was
#going to do this anyway but not at the moment.
Well... suport for these networks would be great. And yes... i can do some tests
for you.....
I''m testing the setup using Kazaa Lite and Overnet.....
Thanks a lot.
LEANDRO TRAVAGLIA
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.619 / Virus Database: 398 - Release Date: 10/3/2004
Hi,> I''m tried to use v0.5b.... but it not worked. Now i''m using v0.4 with no > problems...There has been a bug introduced with IPP2P 0.5rc1 wich lets kazaa downloads still go through but this bug was fixed in 0.5a. I''ll take a look at the current code again.> The rule i''m using...: > iptables -I FORWARD -p tcp -m ipp2p --ipp2p -j DROPRule is fine.> remove the ipt_ipp2p.o mod (v0.4) > configue the Makefile of the 0.5b version > install libipt_ipp2p.so - overwriting the old one > run insmod ipt_ipp2p.o successfully > set iptables -I FORWARD -p tcp -m ipp2p --ipp2p -j DROP > NOTHING HAPPENS - Kazaa can download files again....I''ll review the kazaa code. Can you give me the output of iptables running IPP2P 0.5b again please? If you''re using different p2p networks at once split it into serveral rules like this: iptables -A FORWARD -p tcp -m ipp2p --edk -j DROP iptables -A FORWARD -p tcp -m ipp2p --kazaa -j DROP iptables -A FORWARD -p tcp -m ipp2p --gnu -j DROP etc. and give me the output.> Do you use any kind of traffic shaper? What''s your configuration/rules?As posted on the official homepage example #2. I''m not dropping packets im shaping them.> Well... suport for these networks would be great. And yes... i can do > some tests for you.....This weekend I''ll take a look at this and the kazaa thing as well. I''ll report back to you here with any news. Regards -- +++ NEU bei GMX und erstmalig in Deutschland: TÜV-geprüfter Virenschutz +++ 100% Virenerkennung nach Wildlist. Infos: http://www.gmx.net/virenschutz _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> > Hi, > > > > I had the same problem some time ago, I couldn''t have DNAT working onmy > > second interface. Could you please post all your routing tables? > > And also, what are your connections? Both PPP? PPPoE? ... > > > > OK, I am using Static IP for both links. Here is my routing table :- > ( I use symbolic name here for easier reading .... )[ snip ] I am beginning to think multipath inbound port forwarding is not as simple as constructiong these iptables rules :-> iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 80 -j > DNAT --to ${SERVER}:80 > iptables -A FORWARD -p tcp -d ${SERVER} --dport 801 -o ${INSIDE_DEVICE} > -j ACCEPT> iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP2} --dport 80 -j > DNAT --to ${SERVER}:80 > iptables -A FORWARD -p tcp -d ${SERVER} --dport 801 -o${INSIDE_DEVICE} -j> ACCEPT >Maybe I should ask has anybody gotten this to work before ? The reason I am suspecting this not working is this :- The inbound port forwarding rules are fine as far as receiving the connection, but when it replies will still take the whatever routing path defined by the system. If the system is doing loading balancing, chances is that it will be going via some other interfaces, thereby causing connection problem. So my question is if there is a way to ask the firewall to reply via the interface where it is coming in from ? _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
Hi, I got the time to use an equal setup like yours to test the drop rule.> NOTHING HAPPENS - Kazaa can download files again....Well, i grabbed KaZaA lite (K++) today, installed it on my system (wich is connected to the internet trough a NATing router). IPP2P 0.5b was working perfectly fine, I used the following rule to test: iptables -t filter -I FORWARD 1 -p tcp -m ipp2p --kazaa -j DROP I could not download any more and iptables output looked like this: Chain FORWARD (policy ACCEPT 31525 packets, 1506K bytes) pkts bytes target prot opt in out source destination 11 4780 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 ipp2p v0.5b --kazaa Removing the DROP rule let me download files again. So make sure that you''re insmodding the right ipt_ipp2p.o and that your DROP-rule is in the appropriate place. I''ll look at IMESH and Soulseek tomorrow. Regards -- +++ NEU bei GMX und erstmalig in Deutschland: TÜV-geprüfter Virenschutz +++ 100% Virenerkennung nach Wildlist. Infos: http://www.gmx.net/virenschutz _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
Leandro Andrade Travaglia
2004-Mar-13 02:01 UTC
Re: IPP2P v0.5 not working (but now is) and more...
Thanks a lot...
Well, let''s try again
I''ll put here step-by-step what i''m doing.
I''m logged on as ROOT, ok? Let''s go...
service iptables stop
cd /home/files/ipp2p/0.5b
iptables -V
iptables 1.2.7a
vim Makefile
i edited the file to: IKERNEL = -I/usr/src/linux-2.4.20-8/include
IUSER = -I/home/iptables-1.2.7a/include (i
have downloaded iptables 1.2.7a sources)
NETFILTER_VERSION = \"1.2.7a\"
make
no erros
rm /lib/iptables/libipt_ipp2p.so
remove regular file? YES
cp libipt_ipp2p.so /lib/iptables/
iptables -m ipp2p --help
returns the help of the mod
rmmod ipt_ipp2p
pwd
/home/files/ipp2p/0.5b
insmod ipt_p2p
service iptables start
iptables -L FORWARD
RH-Lokkit-0-50-INPUT all --anywhere anywhere
iptables -t filter -I FORWARD 1 -p tcp -m ipp2p --kazaa -j DROP
iptables -L FORWARD
DROP tcp -- anywhere anywhere ipp2p v0.5b --kazaa
RH-Lokkit-0-50-INPUT..................
But now KAZAA can''t connect - It''s working fine...
Maybe i did something wrong, or the general rule --ipp2p isn''t working
for me.... but i believe that i did something wrong - sorry... anyway, thanks a
lot.... Looking forward for IMESH and SOULSEEK support....
Now i have a few questions....
1 - it is stable for me to use the --bit and --apple? Can it crash my box?
2 - When i try to use ipp2p.gz, the shellscript to automatically start an IPP2P
setup using two network interfaces, it return the following:
Starting IPP2P ... iptables v1.2.7a: Unknown arg `--restore-mark''
Try `iptables -h'' or ''iptables --help'' for more
information.
iptables v1.2.7a: Unknown arg `--save-mark''
Try `iptables -h'' or ''iptables --help'' for more
information.
iptables v1.2.7a: Unknown arg `--set-class''
Try `iptables -h'' or ''iptables --help'' for more
information.
iptables v1.2.7a: Unknown arg `--set-class''
Try `iptables -h'' or ''iptables --help'' for more
information.
done
What is my problem?
3 - Does this shellscript really control the bandwith consuption by the p2p
programs?
Why, for exemple, the wondershaper have much more "rules" and details?
----- Original Message -----
From: miller69@gmx.net
To: lartc@mailman.ds9a.nl
Sent: Friday, March 12, 2004 8:25 AM
Subject: Re: [LARTC] IPP2P v0.5 not working and more...
Hi,
I got the time to use an equal setup like yours to test the drop rule.
> NOTHING HAPPENS - Kazaa can download files again....
Well, i grabbed KaZaA lite (K++) today, installed it on my system (wich is
connected to the internet trough a NATing router). IPP2P 0.5b was working
perfectly fine, I used the following rule to test:
iptables -t filter -I FORWARD 1 -p tcp -m ipp2p --kazaa -j DROP
I could not download any more and iptables output looked like this:
Chain FORWARD (policy ACCEPT 31525 packets, 1506K bytes)
pkts bytes target prot opt in out source
destination
11 4780 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 ipp2p v0.5b --kazaa
Removing the DROP rule let me download files again. So make sure that
you''re insmodding the right ipt_ipp2p.o and that your DROP-rule is in
the
appropriate place. I''ll look at IMESH and Soulseek tomorrow.
Regards
--
+++ NEU bei GMX und erstmalig in Deutschland: TÜV-geprüfter Virenschutz +++
100% Virenerkennung nach Wildlist. Infos: http://www.gmx.net/virenschutz
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.620 / Virus Database: 399 - Release Date: 11/3/2004
miller69@gmx.net
2004-Mar-13 15:51 UTC
Re: IPP2P v0.5 not working (but now is) and more...
Hi again,> iptables -L FORWARD > DROP tcp -- anywhere anywhere ipp2p v0.5b --kazaa > RH-Lokkit-0-50-INPUT.................. > > But now KAZAA can''t connect - It''s working fine...This is surprising as "--ipp2p" is a shortcut for the options "--edk --dc --kazaa --gnu". I''ve tested the current version and both (--kazaa and --ipp2p) block any downloads in kazaa for me.> Maybe i did something wrong, or the general rule --ipp2p isn''t working > for me.... but i believe that i did something wrong - sorry... anyway, > thanks a lot.... Looking forward for IMESH and SOULSEEK support....I''ll send you the next release off-list in a second. Please come back to me with any comment if it''s working etc. If it''s fine I''ll put it on the official website.> 1 - it is stable for me to use the --bit and --apple? Can it crash my > box?Not stable is meant as "I''m not 100% sure if I don''t mark anything else than the p2p-networks". It does not mean that it can crash your box.> 2 - When i try to use ipp2p.gz, the shellscript to automatically start > an IPP2P setup using two network interfaces, it return the following: > 3 - Does this shellscript really control the bandwith consuption by the > p2p programs? > Why, for exemple, the wondershaper have much more "rules" and details?These scripts are just examples how IPP2P is working on my firewalling bridge box. They''re not meant to run flawlessly on your computer without any adaption. Have a look at them, find out how it''s working and add the important things to your current setup/scripts. Regards -- +++ NEU bei GMX und erstmalig in Deutschland: TÜV-geprüfter Virenschutz +++ 100% Virenerkennung nach Wildlist. Infos: http://www.gmx.net/virenschutz _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/