i have a wireless network that is connected to internet over nat.there is ap that is connected to another ap in bridge mode, on ap is used for clients, and the other is connected to the machine that is doing masquerading. so i want to measure traffic of my clients and i thought about doing it with snmp, but ap`s that my clients are using doesn`t have snmp. how can i measure it using iptables?
I spent a lot of time trying to implement outbound traffic filtering with: cgroups + tc + iptables on Debian Jessie. Unfortunately there is still something wrong.
The biggest issue is:
- cgroups install + config
- net_cls subsystem implementation
- packets marking with net_cls
- appropriate... (0 Replies)
I would like to divide traffic between two squid servers.
I have been thinking about using iptables u32 filter, to check last bit of ip address which is comming to gateway. Then I would like to direct even IP adresses to one squid host, and odd to the other. Is it reasonable ?
Thank you for... (2 Replies)
Hi,
I am new to linux stuff. I want to use linux iptables to configure rule so that all my incoming traffic with protocol "tcp" is forwarded to the "FORWARD CHAIN". The traffic i am dealing with has destination addresss of my machine but i want to block it from coming to input chain and somehow... (0 Replies)
hello,
I have a postfix & a local dns running on a single server.
this server is connected to internet via a low bandwidth line(with fixed ip).
we also have another high speed adsl (dynamic ip).
i want to divert all dns request from the local dns & postfix
from the server to the adsl... (0 Replies)
Hi everybody. I have the next scenary:
eth0: WAN
eth1: DMZ
eth2: LAN
I need to block all incoming trafic from the internet through my network LAN using iptables. I have squid but i need to do this using ipatbles.
I have been listening about iptables -A FORDAWARD but I am stuck right... (0 Replies)
I have a Java program. I want to measure the total memory used by the program, especially the peak memory. Is there a way to do it?
I have tried utilities like time (which returns 0) and top (which is not very useful) as the program does not run for long.
Can anyone suggest a way to do this?... (5 Replies)
Hi all!
We have a setup of three computers;
Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0)
hso0 is the packet interface of a 3G modem, it behaves like a normal network interface.
Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a... (2 Replies)
Can anyone please help me in measuring the system call timings!
How do I do it if I have to measure the timing of an operation, say getpid system call.
What different functions can I use for that and what would be the difference using each of them?
Thanx! (3 Replies)
ipkungfu(8) System Manager's Manual ipkungfu(8)NAME
ipkungfu - An iptables-based firewall for Linux
SYNOPSIS
ipkungfu [ -c ] [ -t ] [ -d ] [ -h ] [ -v ] [ --quiet ] [ --panic ] [ --no-caching
DESCRIPTION
ipkungfu is an iptables-based Linux firewall. The primary design goals are security, ease of use, and performance, in that order. It takes
advantage of advanced features of iptables, tcpwrappers, and the Linux kernel. It also simplifies the configuration of internet connection
sharing, advanced routing, and other networking needs.
OPTIONS -c (or --check)
Check whether ipkungfu is loaded, and report any command line options it may have been loaded with.
-t (or --test)
Runs a configuration test, and displays the results. Note that this does not test or display all configuration options. This
gives you an opportunity to verify that major configuration options are correct before putting them into action.
-d (or --disable)
Disables the firewall. It is important to know exactly what this option does. All traffic is allowed in and out, and in the
case of a gateway, all NATed traffic is forwarded (the option retains your connection sharing options). Custom rules are not
implemented, and deny_hosts.conf is ignored.
-f (or --flush)
Disables the firewall COMPLETELY. All rules are flushed, all chains are removed. Any port forwarding or internet connection
sharing will cease to work.
-h (or --help)
Displays brief usage information and exits.
-v (or --version)
Displays version information and exits.
--quiet Runs ipkungfu with no standard output
--panic Drops ALL traffic in all directions on all network interfaces. You should probably never use this option. The --panic option
is available for the highly unusual situation where you know that an attack is underway but you know of no other way to stop
it.
--failsafe If ipkungfu fails, --failsafe will cause all firewall policies to revert to ACCEPT. This is useful when working with ipkungfu
remotely, to prevent loss of remote access due to firewall failure.
--no-caching
Disables rules caching feature.
FILES
/etc/ipkungfu/ipkungfu.conf
/etc/ipkungfu/advanced.conf
/etc/ipkungfu/accept_hosts.conf
/etc/ipkungfu/deny_hosts.conf
/etc/ipkungfu/custom.conf
/etc/ipkungfu/log.conf
/etc/ipkungfu/redirect.conf
/etc/ipkungfu/services.conf
/usr/sbin/ipkungfu
/usr/share/doc/ipkungfu/AUTHORS
/usr/share/doc/ipkungfu/README
/usr/share/doc/ipkungfu/FAQ
/usr/share/doc/ipkungfu/ChangeLog
/usr/share/doc/ipkungfu/COPYING
SEE ALSO iptables(8).
January 2003 ipkungfu(8)