[LARTC] Ssh flow does not go into correct class. Help!

[Catalin(ux aka Dino) BOIE]

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

---1646943047-1200082233-1106811871=:12972
Content-Type: TEXT/PLAIN; CHARSET=iso-8859-1; FORMAT=flowed
Content-Transfer-Encoding: 8BIT
Content-ID: <Pine.LNX.4.62.0501270944351.12972@webhosting.rdsbv.ro>

On Thu, 27 Jan 2005, CcM wrote:

> Now I want to control ports with ips specified, like following, it seems not work, only --sport effect. Ftp-data goes to ips beside 10.190.6.16 also goes into 1:12 while default is 1:13. Why?
>
> tc qdisc add dev eth0 root handle 1: htb default 13
> tc class add dev eth0 parent 1: classid 1:1 htb rate 80000kbit ceil 80000kbit prio 1
> tc class add dev eth0 parent 1:1 classid 1:11 htb rate 40kbit ceil 40kbit prio 1
> tc class add dev eth0 parent 1:1 classid 1:12 htb rate 800kbit ceil 1600kbit prio 1
> tc class add dev eth0 parent 1:1 classid 1:13 htb rate 70000kbit ceil 80000kbit prio 1
> tc qdisc add dev eth0 parent 1:11 handle 111: sfq perturb 5
> tc qdisc add dev eth0 parent 1:12 handle 112: sfq perturb 5
> tc qdisc add dev eth0 parent 1:13 handle 113: sfq perturb 5
>
> iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 22 -j MARK --set-mark 20
> iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 22 -j RETURN
>
> iptables -t mangle -A POSTROUTING -d 10.190.6.16  -p tcp --sport ftp-data -j MARK --set-mark 21
> iptables -t mangle -A POSTROUTING -d 10.190.6.16 -p tcp --sport ftp-data -j RETURN

I bet you use passive mode in ftp so you get a weird port, not ftp-data 
(20). ftp is tricky to match. You can use this:
iptables -t mangle -A POSTROUTING -d x.x.x.x -m helper --helper ftp \
 	-j MARK --set-mark 21
This will mark with 21 all ftp control+data connections.

>
> tc filter add dev eth0 parent 1:0 prio 1 protocol ip handle 20 fw flowid 1:11
> tc filter add dev eth0 parent 1:0 prio 1 protocol ip handle 21 fw flowid 1:12
>
>
> "Catalin(ux aka Dino) BOIE" <util@deuroconsult.ro> wrote:
> On Wed, 26 Jan 2005, CcM wrote:
>
>> It does work! Thanks!
>> But many articles write like what I did, what's the difference between POSTROUTING and PREROUTING. I mean I know these are two hook point in ip stack, but why should be POSTROUTING here when do mangle?
>>
>> "Catalin(ux aka Dino) BOIE" wrote:
>> Use:
>> iptables -t mangle -A POSTROUTING -p tcp -m tcp --sport 22 -j MARK \
>> --set-mark 20
>
> Because local generated packets doesn't go through PREROUTING.
> But, best is to use OUTPUT.
>
>>
>> ---
>> Catalin(ux aka Dino) BOIE
>> catab at deuroconsult.ro
>> http://kernel.umbrella.ro/
>> _______________________________________________
>> LARTC mailing list / LARTC@mailman.ds9a.nl
>> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>>
>>
>>
>> ---------------------------------
>> Do You Yahoo!?
>> 注册世界一流品质的雅虎免费电邮
>
> ---
> Catalin(ux aka Dino) BOIE
> catab at deuroconsult.ro
> http://kernel.umbrella.ro/
>
>
> ---------------------------------
> Do You Yahoo!?
> 注册世界一流品质的雅虎免费电邮

---
Catalin(ux aka Dino) BOIE
catab at deuroconsult.ro
http://kernel.umbrella.ro/
---1646943047-1200082233-1106811871=:12972--