Hi
Having a problem trying to figure out how to shape local services
running on the debian box (asterisk, squid etc) as currently the voice
only seems to be getting shaped one way when making external calls. For
example I have the rules below (these are the matching rules only not
the actual policy rules):
#Create Chain for local traffic (outbound)
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s
193.xxx.xxx.66 -d 193.xxx.xxx.69 -j MARK --set-mark 0x44444445
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s
193.xxx.xxx.66 -d 193.xxx.xxx.69 -j RETURN
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s
193.xxx.xxx.69 -d 193.xxx.xxx.66 -j MARK --set-mark 0x44444445
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s
193.xxx.xxx.69 -d 193.xxx.xxx.66 -j RETURN
#Create Chain for all remaining traffic (outbound)
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -j
MARK --set-mark 0x44444446
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -j
RETURN
#Phones match (outbound)
/sbin/iptables -t mangle -A match-chain-eth1-1:11 -p tcp -m multiport
--port 4569 -j CLASSIFY --set-class 1:1006
/sbin/iptables -t mangle -A match-chain-eth1-1:11 -p tcp -m multiport
--port 4569 -j RETURN
/sbin/iptables -t mangle -A match-chain-eth1-1:11 -p udp -m multiport
--port 4569 -j CLASSIFY --set-class 1:1006
/sbin/iptables -t mangle -A match-chain-eth1-1:11 -p udp -m multiport
--port 4569 -j RETURN
#Create Chain for local traffic (inbound)
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s
193.xxx.xxx.66 -d 193.xxx.xxx.69 -j MARK --set-mark 0x44444447
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s
193.xxx.xxx.66 -d 193.xxx.xxx.69 -j RETURN
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s
193.xxx.xxx.69 -d 193.xxx.xxx.66 -j MARK --set-mark 0x44444447
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s
193.xxx.xxx.69 -d 193.xxx.xxx.66 -j RETURN
#Create Chain for all remaining traffic (inbound)
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -j
MARK --set-mark 0x44444448
/sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -j
RETURN
#Phones match (inbound)
/sbin/iptables -t mangle -A match-chain-eth0-1:12 -p tcp -m multiport
--port 4569 -j CLASSIFY --set-class 1:2008
/sbin/iptables -t mangle -A match-chain-eth0-1:12 -p tcp -m multiport
--port 4569 -j RETURN
/sbin/iptables -t mangle -A match-chain-eth0-1:12 -p udp -m multiport
--port 4569 -j CLASSIFY --set-class 1:2008
/sbin/iptables -t mangle -A match-chain-eth0-1:12 -p udp -m multiport
--port 4569 -j RETURN
Kind Regards
William Bohannan
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
