Packet Marking (Mangle)

Transcription

1 Packet Marking (Mangle) Document revision 2.5 (Mon May 17 12:52:24 GMT 2004) This document applies to V2.8 Table of Contents Table of Contents General Information Summary Quick Setup Guide Specifications Related Documents Mangle Description Property Description Example How to Mangle NATted Traffic General Information Summary Quick Setup Guide http-traffic ip firewall mangle> src-address= /24 \ \... dst-port=80 mark-flow=http-traffic Specifications Packages required: system License required: level1 Home menu level: /ip firefall mangle Standards and Technologies: IP Hardware usage: Increases with rules and connections count Related Documents Page 1 of 5

2 Mangle Description Type of Service exempli gratia low-cost - minimize monetary cost low-delay - minimize delay normal - normal service max-reliability - maximize reliability max-throughput - maximize throughput Property Description Page 2 of 5

3 action (accept passthrough; default: accept) - action to undertake if the packet matches the rule, one of the: accept - accept the packet applying the appropriate attributes (marks, MSS), and no more rules are processed in the list passthrough - apply the appropriate attributes (marks, MSS), and go on to the next rule disabled (yes no; default: no) - specifies, whether the rule is disabled or not in-interface (name; default: all) - interface the packet has entered the router through. If the default value all is used, it may include the local loopback interface for packets originated from the router src-address (IP address; default: /0: ) - source IP address src-netmask (IP address; default: accept) - source netmask in decimal form x.x.x.x src-port (integer: ; default: ) - source port number or range 0 - all ports from 01 to comment (text; default: "") - a descriptive comment for the rule dst-address (IP address; default: /0: ) - destination IP address dst-netmask (IP address; default: accept) - destination netmask in decimal form x.x.x.x dst-port (integer: ; default: ) - destination port number or range 0 - all ports from 1 to icmp-options (integer; default: any:any) - matches ICMP Type:Code fields tcp-options (any syn-only non-syn-only; default: any) - TCP options protocol (ah egp ggp icmp ipencap ospf rspf udp xtp all encap gre idpr-cmtp ipip pup st vmtp ddp esp hmp igmp iso-tp4 rdp tcp xns-idp; default: all) - protocol setting all - cannot be used, if you want to specify ports content (text; default: "") - the text packets should contain in order to match the rule flow (text) - flow mark to match. Only packets marked in the MANGLE would be matched p2p (any all-p2p bit-torrent direct-connect fasttrack soulseek blubster edonkey gnutella warez; default: any) - match Peer-to-Peer (P2P) connections: all-p2p - match all known P2P traffic any - match any packet (i.e., do not check this property) connection (text; default: "") - connection mark to match. Only connections (including related) marked in the MANGLE would be matched limit-burst (integer; default: 0) - allowed burst regarding the limit-count/limit-time limit-time (time; default: 0) - time interval, used in limit-count 0 - forever limit-count (integer; default: 0) - how many times to use the rule during the limit-time period src-mac-address (MAC address; default: 00:00:00:00:00:00) - host's MAC address the packet has been received from log (yes no; default: no) - specifies to log the action or not mark-flow (text; default: "") - change flow mark of the packet to this value mark-connection (text; default: "") - change connection mark of the packet to this value tcp-mss (integer dont-change; default: dont-change) - change MSS of the packet Page 3 of 5

4 dont-change - leave MSS of the packet as is tos (any max-reliability max-throughput min-cost min-delay normal integer; default: any) - specifies a match for Type-of-Service field of an IP packet any - matches any ToS value set-tos (max-reliability max-throughput min-cost min-delay normal dont-change; default: dont-change) - changes the value of Type-of-Service field of an IP packet dont-change - do not change the value of Type-of-Service field normal (ToS=0) - router will treat datagram as normal traffic min-cost (ToS=2) - router will try to pass datagrams using routes with the lowest cost possible max-reliability (ToS=4) - router will try to pass datagrams using routes which have propognated themselves as reliable regarding the loss of the datagrams. Useful for important traffic such as routing information max-throughput (ToS=8) - router will try to choose routes with the highest bandwidth available. Useful for applications that use much traffic, such as FTP (when sending data) min-delay (ToS=16) - router will try to pass the datagrams with lowest delay possible. Useful for interactive applications, for example, telnet Example mark-flow action=passthrough [admin@test_1] ip firewall mangle> add action=passthrough mark-flow=myflow [admin@test_1] ip firewall mangle> print Flags: X - disabled, I - invalid, D - dynamic 0 src-address= /0: in-interface=all dst-address= /0: protocol=all tcp-options=any limit-time=0s action=passthrough mark-flow=myflow tcp-mss=dont-change [admin@test_1] ip firewall mangle> tcp-mss [admin@test_1] ip firewall mangle> add protocol=tcp\ \.. tcp-options=syn-only action=passthrough tcp-mss=1448 [admin@test_1] ip firewall mangle> print Flags: X - disabled, I - invalid, D - dynamic 0 src-address= /0: in-interface=all dst-address= /0: protocol=all tcp-options=any limit-time=0s action=passthrough mark-flow=myflow tcp-mss=dont-change 1 src-address= /0: in-interface=all dst-address= /0: protocol=tcp tcp-options=syn-only limit-time=0s action=passthrough mark-flow="" tcp-mss=1448 [admin@test_1] ip firewall mangle> Application Examples Page 4 of 5

5 How to Mangle NATted Traffic /ip firewall mangle add src-address= /24 action=passthrough mark-connection=nat_conn /ip firewall mangle add connection=nat_conn mark-flow=my_clients /queue tree my_clients Page 5 of 5