| View previous topic :: View next topic |
| Author |
Message |
Pette
n00b
Joined: 14 Feb 2004
Posts: 46
Location: Hamburg / Germany
|
 Posted: Sat Aug 12, 2006 11:40 am Post subject: Shorewall & Layer7-Support |
 |
|
Hey there.
Is there anyone who has shorewall running with layer7-support?
Is there a good howto on this somewhere? I found some howtos for layer7 and some for shorewall, but not one for both.
Any help appreciated.
Greetz, Pette. |
|
| Back to top |
|
 |
Pette
n00b
Joined: 14 Feb 2004
Posts: 46
Location: Hamburg / Germany
|
| Posted: Mon Aug 14, 2006 4:03 pm Post subject: |
|
|
| Has noone really ever made an attempt on this? I would be very interested! |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Mon Aug 14, 2006 8:27 pm Post subject: |
|
|
| A little more specific example of what you are trying to do would help. |
|
| Back to top |
|
|
-Craig-
Guru
Joined: 03 Jun 2004
Posts: 333
|
| Posted: Mon Aug 14, 2006 9:17 pm Post subject: |
|
|
I guess things like filtering a website that contains a certain word?
Or filtering outgoing HTTPS (HTTP CONNECT) to port 443 that contains something like "SSH-2.0-OpenSSH_4.3" ?
Well, iptables is capable of filtering strings since 2001: http://www.securityfocus.com/infocus/1531
Or check this out: http://l7-filter.sourceforge.net/ |
|
| Back to top |
|
|
Pette
n00b
Joined: 14 Feb 2004
Posts: 46
Location: Hamburg / Germany
|
| Posted: Mon Aug 14, 2006 9:53 pm Post subject: |
|
|
Thats exactly what I ment. Sorry I didn't mention it in my first post already...
On http://l7-filter.sourceforge.net/HOWTO#Doing they show an example of Bandwidth-Restriction:
| Code: | | iptables -t mangle -A POSTROUTING -m layer7 --l7proto imap -j MARK --set-mark 3 |
then | Code: | | tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 3 fw flowid 1:3 |
Thats kind of what I want to accomplish using shorewall, instead of using iptables and tc directly.
Hope this makes it a little more clear.
Greetz, Pette. |
|
| Back to top |
|
|
thepustule
Apprentice
Joined: 22 Feb 2004
Posts: 212
Location: Toronto, Canada
|
| Posted: Mon Aug 14, 2006 10:58 pm Post subject: |
|
|
| I'd be worried about how much this might slow your network throughput or raise cpu during high traffic |
|
| Back to top |
|
|
-Craig-
Guru
Joined: 03 Jun 2004
Posts: 333
|
| Posted: Tue Aug 15, 2006 10:44 am Post subject: |
|
|
| I'd have a try at least... |
|
| Back to top |
|
|
assaf
Apprentice
Joined: 14 Feb 2005
Posts: 152
Location: http://localhost
|
| Posted: Tue Aug 15, 2006 10:45 am Post subject: |
|
|
| I used the l7-filter package a while back to do some traffic shaping. It worked okay I guess, until a kernel upgrade broke it. Also in the meantime a newer shorewall version was released that has internal traffic shaping and allows you to write rules for user/group. So I started using that instead (I run file sharing progs under p2p user, so I use that for shaping). |
|
| Back to top |
|
|
Pette
n00b
Joined: 14 Feb 2004
Posts: 46
Location: Hamburg / Germany
|
| Posted: Tue Aug 15, 2006 6:49 pm Post subject: |
|
|
| assaf wrote: | | I used the l7-filter package a while back to do some traffic shaping. It worked okay I guess, until a kernel upgrade broke it. |
Did you use shorewall with the l7-filters? If so, can you tell me how? |
|
| Back to top |
|
|
assaf
Apprentice
Joined: 14 Feb 2005
Posts: 152
Location: http://localhost
|
| Posted: Tue Aug 15, 2006 8:05 pm Post subject: |
|
|
| Pette wrote: | | assaf wrote: | | I used the l7-filter package a while back to do some traffic shaping. It worked okay I guess, until a kernel upgrade broke it. |
Did you use shorewall with the l7-filters? If so, can you tell me how? |
Well, not directly. I had a custom script run from shorewall as tcstart. Basically copied it from some iptables how-to. |
|
| Back to top |
|
|
Pette
n00b
Joined: 14 Feb 2004
Posts: 46
Location: Hamburg / Germany
|
| Posted: Fri Aug 18, 2006 9:33 pm Post subject: |
|
|
| assaf wrote: | | Well, not directly. I had a custom script run from shorewall as tcstart. Basically copied it from some iptables how-to. |
Hm, so it seems like its not possible to include l7-filters in shorewall directly at the moment, right? Or does anybody else have an idea how to accomplish this? |
|
| Back to top |
|
|
|
Networking & Security
