<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Rockwell;
panose-1:2 6 6 3 2 2 5 2 4 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hi<o:p></o:p></p>
<p class=MsoNormal>Having a problem trying to figure out how to shape local
services running on the debian box (asterisk, squid etc) as currently the voice
only seems to be getting shaped one way when making external calls. For
example I have the rules below (these are the matching rules only not the
actual policy rules):<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Create Chain for local traffic (outbound)<o:p></o:p></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth0 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j MARK
--set-mark 0x44444445<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth0 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j RETURN<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth0 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66 -j MARK --set-mark
0x44444445<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables
-t mangle -A match-all -m physdev --physdev-in eth0 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66
-j RETURN</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Create Chain for all remaining traffic (outbound)<o:p></o:p></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth0 -j MARK --set-mark 0x44444446<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables
-t mangle -A match-all -m physdev --physdev-in eth0 -j RETURN</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Phones match (outbound)<o:p></o:p></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-chain-eth1-1:11
-p tcp -m multiport --port 4569 -j CLASSIFY --set-class 1:1006<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-chain-eth1-1:11
-p tcp -m multiport --port 4569 -j RETURN<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-chain-eth1-1:11
-p udp -m multiport --port 4569 -j CLASSIFY --set-class 1:1006<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables
-t mangle -A match-chain-eth1-1:11 -p udp -m multiport --port 4569 -j RETURN</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Create Chain for local traffic (inbound)<o:p></o:p></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth1 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j MARK
--set-mark 0x44444447<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth1 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j RETURN<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth1 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66 -j MARK
--set-mark 0x44444447<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables
-t mangle -A match-all -m physdev --physdev-in eth1 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66
-j RETURN</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Create Chain for all remaining traffic (inbound)<o:p></o:p></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-all
-m physdev --physdev-in eth1 -j MARK --set-mark 0x44444448<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables
-t mangle -A match-all -m physdev --physdev-in eth1 -j RETURN</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>#Phones match (inbound)<o:p></o:p></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-chain-eth0-1:12
-p tcp -m multiport --port 4569 -j CLASSIFY --set-class 1:2008<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-chain-eth0-1:12
-p tcp -m multiport --port 4569 -j RETURN<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span lang=EN-GB
style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables -t mangle -A match-chain-eth0-1:12
-p udp -m multiport --port 4569 -j CLASSIFY --set-class 1:2008<o:p></o:p></span></p>
<p class=MsoNormal><span lang=EN-GB style='font-size:9.0pt;font-family:"Courier New"'>/sbin/iptables
-t mangle -A match-chain-eth0-1:12 -p udp -m multiport --port 4569 -j RETURN</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Rockwell","serif";
color:#1F497D'>Kind Regards<o:p></o:p></span></p>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Rockwell","serif";
color:#1F497D'>William Bohannan</span></b><b><span style='font-size:12.0pt;
color:#1F497D'><o:p></o:p></span></b></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>