$ man iptables connrate This module matches the current transfer rate in a connection. --connrate [!] [from]:[to] Match against the current connection transfer rate being within ’from’ and ’to’ bytes per second. When the "!" argument is used before the range, the sense of the match is inverted. dstlimit This module allows you to limit the packet per second (pps) rate on a per destination IP or per destination port base. As opposed to the ‘limit’ match, every destination ip / destination port has it’s own limit. --dstlimit avg Maximum average match rate (packets per second unless followed by /sec /minute /hour /day postfixes). --dstlimit-mode mode The limiting hashmode. Is the specified limit per dstip, dstip-dstport tuple, srcip-dstip tuple, or per srcipdstip-dst‐ port tuple. --dstlimit-name name Name for /proc/net/ipt_dstlimit/* file entry [--dstlimit-burst burst] Number of packets to match in a burst. Default: 5 [--dstlimit-htable-size size] Number of buckets in the hashtable [--dstlimit-htable-max max] Maximum number of entries in the hashtable [--dstlimit-htable-gcinterval interval] Interval between garbage collection runs of the hashtable (in miliseconds). Default is 1000 (1 second). [--dstlimit-htable-expire time After which time are idle entries expired from hashtable (in miliseconds)? Default is 10000 (10 seconds). fuzzy This module matches a rate limit based on a fuzzy logic controller [FLC] --lower-limit number" Specifies the lower limit (in packets per second). --upper-limit number Specifies the upper limit (in packets per second). hashlimit This patch adds a new match called ’hashlimit’. The idea is to have something like ’limit’, but either per destination-ip or per (des‐ tip,destport) tuple. It gives you the ability to express ’1000 packets per second for every host in 192.168.0.0/16’ ’100 packets per second for every service of 192.168.1.1’ with a single iptables rule. --hashlimit rate A rate just like the limit match --hashlimit-burst num Burst value, just like limit match --hashlimit-mode destip | destip-destport Limit per IP or per port --hashlimit-name foo The name for the /proc/net/ipt_hashlimit/foo entry --hashlimit-htable-size num The number of buckets of the hash table --hashlimit-htable-max num Maximum entries in the hash --hashlimit-htable-expire num After how many miliseconds do hash entries expire --hashlimit-htable-gcinterval num How many miliseconds between garbage collection intervals quota Implements network quotas by decrementing a byte counter with each packet. --quota bytes The quota in bytes. KNOWN BUGS: this does not work on SMP systems. time This matches if the packet arrival time/date is within a given range. All options are facultative. --timestart value Match only if it is after ‘value’ (Inclusive, format: HH:MM ; default 00:00). --timestop value Match only if it is before ‘value’ (Inclusive, format: HH:MM ; default 23:59). --days listofdays Match only if today is one of the given days. (format: Mon,Tue,Wed,Thu,Fri,Sat,Sun ; default everyday) --datestart date Match only if it is after ‘date’ (Inclusive, format: YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s start from 0 ; default to 1970) --datestop date Match only if it is before ‘date’ (Inclusive, format: YYYY[:MM[:DD[:hh[:mm[:ss]]]]] ; h,m,s start from 0 ; default to 2037) NFQUEUE This target is an extension of the QUEUE target. As opposed to QUEUE, it allows you to put a packet into any specific queue, identified by its 16-bit queue number. --queue-num value This specifies the QUEUE number to use. Valud queue numbers are 0 to 65535. The default value is 0. It can only be used with Kernel versions 2.6.14 or later, since it requires the nfnetlink_queue kernel support.....................
ipfw - провокативний русизм порівняно з iptables
Гм... цікаво на що здатний ipfw v2.
Хоча можливості сучасних екранів настільки потужні, що реалізація конкретного екрану більше залежатиме від знань того хто його пише, а не від iptables чи ipfw...
Ну і напевно не можна пересилати пакети користувацьким прогам і там їх ледве не побітно аналізувати...
Я про користь подумав, а не про небезпеку , можна було б приклади реалізації iptables & ipfw розмістити на DLOU тож їх можна буде всім поправляти...
Також я мав на увазі що вся фільтрація повинна здійснюватись на рівні ядра, тобто не бажано divert-том завертати трафік до користувацьких програм, а потім повертати його для подальшої фільтрації в ipfw.
iptables -t filter -A OUTPUT -p ALL -o eth0 -s 10.0.0.10 -d 10.0.0.0/24 -j ACCEPTiptables -t filter -A OUTPUT -p ALL -o eth0 -s 10.0.0.10 -d 0/0 -m fuzzy --upper-limit 42 -j ACCEPTiptables -t mangle -A PREROUTING -p ALL -i eth0 -s 10.0.0.0/24 -d 10.0.0.10 -j ACCEPTiptables -t mangle -A PREROUTING -p ALL -i eth0 -s 0/0 -d 10.0.0.10 -m fuzzy --upper-limit 42 -j ACCEPT
iptables -t mangle -A PREROUTING -p ALL -i eth1 -s 10.0.0.10 -d 10.0.0.254 -j ACCEPTiptables -t mangle -A PREROUTING -p ALL -i eth1 -s 10.0.0.10 -d 0/0 -m fuzzy --upper-limit 42 -j ACCEPTiptables -t mangle -A FORWARD -p ALL -i eth0 -s 0/0 -d 10.0.0.10 -m fuzzy --upper-limit 42 -j ACCEPTiptables -t mangle -A FORWARD -p ALL -i eth0 -s 0/0 -d 10.0.0.0/24 -j ACCEPT
