Re:[LARTC] Re: [LARTC]probably solved... why all goes to default!!

[trepo]

  |---class X htb = qdisc X
  | |---class Y == qdicsY  
  | |---class Z == qdicsZ  
  |---class A

Just a guess, but:
In this configuration the root qdisc (to which your filters are attached)
doesn't know anything about classes Y and Z; it only sees _class_ X and A.
So it cannot direct the traffic to Y or Z.
Also this way you increase the delay on the link:

HTB as child of another HTB is NOT the same as class under another
class within the same HTB. It is because when class in HTB can send it
will send as soon as hardware equipment can. So that delay of underlimit
class is limited only by equipment and not by ancestors.
In HTB under HTB case the outer HTB simulates new hardware equipment
with all consequences (larger delay)
(Taken from the HTB User Guide -
http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm)

~ tv ~


___
LARTC mailing list / [EMAIL PROTECTED]
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] port forwarding to different servers with nat

[trepo]

If you are in control of the clients accessing the servers, then
Lawrence MacIntyre [EMAIL PROTECTED] is right... otherwise not. The
clients --unless configured otherwise-- will always look for the requested
services on the standard ports (i.e. http on port 80), so if you have
multiple servers running the same service, you are out of luck. The router
doing DNAT has no way of telling which server it has to forward to, as all
requests come in with the same destination IP and the same port.

The case with different services is easier to solve: you set up your
iptables rulesets to forward the service ports to the appropriate machine.

iptables -t nat -A PREROUTING -p tcp --dport {service-port} -j DNAT --to
{server-ip:port}

You may replace 'tcp' with 'udp', depending on the protocol used (see the
iptables manpage).

 But how do the return packets get rewritten?

 iptables -t nat -A POSTROUTING -s wilma -j SNAT --to external
 iptables -t nat -A POSTROUTING -s fred -j SNAT --to external

 ...seems wrong. Or does it work just fine? (I can't test it right now,
 unfortuantely)

No, that's right. The return packets are sent to the requester's address,
which has never got rewritten along the way... (not at your box, at least
:) )

Please correct me if I'm wrong.

[EMAIL PROTECTED]

___
LARTC mailing list / [EMAIL PROTECTED]
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/