Latvijas/Ārvalstu trafika zīmēšana

Uzdevums: Nepieciešams uzzināt Latvijas un pārējā trafika apjomu vienai vai vairākām tīkla kartēm. Šim nolūkam ar IPTABLES tiks marķēts Latvijas trafiks (neLatvijas - tas, kas nav nomarķēts), ar rrdtool līdzekļiem tas tiks uzkrāts un zīmētas diagrammas.

1. Latvijas tīklu iegūšana un IPTABLES uzstādīšana

#!/bin/bash

DARBADIR="/etc/iptables"
INTERFEISI="eth2 vlan0015 vlan0050"

# Novelkam Latvijas tīklu adreses
wget www.nic.lv/local.net -q -O -  | grep '^[1-9]' | sort -n  > $DARBADIR/local.net

#Iezimeejam visus Latvijas savienojumus  ar mangle  ==
cat $DARBADIR/local.net | while read LVNET
      do
      iptables -t mangle -A PREROUTING --src $LVNET -j MARK --set-mark 0x14
      iptables -t mangle -A POSTROUTING --dst $LVNET -j MARK --set-mark 0x14
done

# Uzliekam skaitiitaajus muus intereseejoshiem interfeisiem visiem (NE)LATVIJAS tiikliem

for i in $INTERFEISI
      do
      #skaitam ienaakosho aarvalstu trafiku
      iptables -t mangle -A PREROUTING  -i $i -m mark ! --mark 0x14
      #skaitam ienaakosho Latvijas trafiku
      iptables -t mangle -A PREROUTING  -i $i -m mark --mark 0x14
      #skaitam izejosho aarvalstu trafiku
      iptables -t mangle -A POSTROUTING -o $i -m mark ! --mark 0x14
      #skaitam izejosho Latvijas trafiku
      iptables -t mangle -A POSTROUTING -o $i -m mark --mark 0x14
done

Protams, šajā skriptā ir ierakstītas tikai tās lietas, kas attiecas uz pakešu marķēšanu. Parasti iptables skriptos ir ierakstīti arī citi pasākumi. Vienīgi jāatceras, ka ausgtākminētajiem PRE/POSTROUTING ierakstiem ir jābūt pirmajiem "mangle" tabulā.

2. Skaitītāju savākšana, uzglabāšana un diagrammu zīmēšana

Skripts, kas ar rrdtools un iptables palīdzību savāc, uzglabā un zīmē diagrammas. Šeit tas ir realizēts vienā skriptā, bet diagrammu zīmēšanu būtu lietderīgi veidot jaunā skriptā, kas tiek palaists ik pēc 5 - 15 minūtēm, nevis katras 10 sekundes. Diagrammas varētu papildināt arī ar MIN-MAX rādītājiem, jo pašas rrd datubāzes uzkrāj šos lielumus. Viss, protams, ir uzprišināms un maināms un uzlabojams.

#!/bin/bash

DARBADIR="/etc/iptables
WEBDIR="/var/pub/"
INTERFEISI="eth2 vlan0015 vlan0050"

cd $DARBADIR

for i in $INTERFEISI
do
# Ja rrd datubaaze nav izveidota - uztaisam to
if [ ! -f m-$i.rrd ]
  then
rrdtool create m-$i.rrd --step 10 \
DS:lvin:COUNTER:300:0:1000000000000 \
DS:lvout:COUNTER:300:0:1000000000000 \
DS:nelvin:COUNTER:300:0:1000000000000 \
DS:nelvout:COUNTER:300:0:1000000000000 \
RRA:AVERAGE:0:1:720 \
RRA:AVERAGE:0.3:6:2880 \
RRA:AVERAGE:0.3:60:2016 \
RRA:AVERAGE:0.3:360:1488 \
RRA:AVERAGE:0.3:4320:1460 \
RRA:MIN:0.3:6:2880 \
RRA:MIN:0.3:60:2016 \
RRA:MIN:0.3:360:1488 \
RRA:MIN:0.3:4320:1460 \
RRA:MAX:0.3:6:2880 \
RRA:MAX:0.3:60:2016 \
RRA:MAX:0.3:360:1488 \
RRA:MAX:0.3:4320:1460
fi

rrdtool update m-$i.rrd -t lvin:lvout:nelvin:nelvout N:\
`iptables -nvxL PREROUTING -t mangle | grep $i.*"match 0x14" | awk '{print $2}'`:\
`iptables -nvxL POSTROUTING -t mangle | grep $i.*"match 0x14" | awk '{print $2}'`:\
`iptables -nvxL PREROUTING -t mangle | grep $i.*"match \!0x14" | awk '{print $2}'`:\
`iptables -nvxL POSTROUTING -t mangle | grep $i.*"match \!0x14" | awk '{print $2}'`

rrdtool graph $WEBDIR/m-$i.png  --end now --start end-1800s --width 1000 --height 400 -v Bps \
  DEF:lvin=m-$i.rrd:lvin:AVERAGE \
  DEF:lvout=m-$i.rrd:lvout:AVERAGE \
  DEF:nelvout=m-$i.rrd:nelvout:AVERAGE \
  DEF:nelvin=m-$i.rrd:nelvin:AVERAGE \
  "CDEF:clvout=0,lvout,-" \
  "CDEF:cnelvout=0,nelvout,-" \
  LINE1:lvin#0000FF:"LV_IN" \
  LINE1:clvout#00CCFF:"LV_OUT" \
  LINE1:nelvin#FF00FF:"NELV_IN" \
  LINE1:cnelvout#FF5533:"NELV_OUT"

rrdtool graph $WEBDIR/m-$i-8h.png  --end now --start end-8h --width 1000 --height 400 -v Bps\
  DEF:lvin=m-$i.rrd:lvin:AVERAGE \
  DEF:lvout=m-$i.rrd:lvout:AVERAGE \
  DEF:nelvout=m-$i.rrd:nelvout:AVERAGE \
  DEF:nelvin=m-$i.rrd:nelvin:AVERAGE \
  "CDEF:clvout=0,lvout,-" \
  "CDEF:cnelvout=0,nelvout,-" \
  LINE1:lvin#0000FF:"LV_IN" \
  LINE1:clvout#00CCFF:"LV_OUT" \
  LINE1:nelvin#FF00FF:"NELV_IN" \
  LINE1:cnelvout#FF5533:"NELV_OUT"
done

3. Trafika skaitīšana

Skaitīšanas skripts ir jāstartē ik pēc 10sek. (tādas mums rrd bāzes uztaisītas). To var laist gan no CRON, gan, piemēram,:

while : ; do bash ./skaita.sh ; sleep 10 ; done

DNAT routing over second link

The problem:

• You have 2 connnections to the Internet - A is the default link, B - secondary link.
• You have hosts inside LAN which are DNAT'ed from B space IP addresses.
• Provider A blocks IP addresses from B address space
• on router you have DNAT'ed some hosts to LAN and SNAT'ed all outgoing IP addresses on A and B interfaces.

Although you have already build some ip routes un rules to answer to packets on exactly the same interfaces, where incoming connections occurs, the DNAT'ed LAN hosts routes all outgoing packets over default - A link with SNAT'ed addresses from B space.

To correct this, you should:

• add corresponding iproute2 table (if not already exist)
• mark all outgoing packets from specified LAN host(s) with iptables PREROUTING chain
• add ip rule to route marked packets through specified table and gateway

## script - all other routes and configurations skipped
## you should add this only one time
# echo 200 bprovider >> /etc/iproute2/rt_tables
...
## add routes to B space and gateway - all in bprovider table
ip route add $B-NET dev $B-DEV src $B-IP table bprovider
ip route add default via $B-GW table bprovider

## add rule to answer all incoming connections to B space over B gateway
ip rule add from $B-IP table bprovider

## iptables part - DNAT incoming packets, SNAT outgoing packets, and mark LAN packets - only for B addresses.
## Only some http ports (80,443) are redirected to LAN host
...
iptables -t nat -A PREROUTING -d $B-IP -m multiport -p tcp --dports 80,443 -j DNAT --to $LAN_IP
iptables -t nat -A POSTROUTING -o $B-DEV -j SNAT --to-source $B-IP
iptables -t mangle -A PREROUTING -s $LAN_IP -j MARK --set-mark 99
...
## and finally - order marked packets to routed over B gateway
ip rule add fwmark 99 table bprovider

Some other approach with CONNMARK (don't tested yet): http://home.regit.org/?page_id=7