2.6内核桥接模式下如何用IPTABLES+IPP2P控制P2P流量?

kong@xm

哪位老兄说说2.6内核桥接模式下如何用IPTABLES+IPP2P+TC控制P2P流量.

[ 本帖最后由 kong@xm 于 2006-10-20 09:25 编辑 ]

platinum

http://www.ipp2p.org/faq_en.html

kong@xm

在路由模式下,已经成功实现,现在主要是在桥接模式下要如何实现.好象开了桥接模式后,数据包不经过IPTABLES 的mangle表了.

platinum

没研究过。。。

dzb_01

iptables -m physdev -h

kong@xm

kong@xm

原帖由 dzb_01 于 2006-10-20 10:55 发表
iptables -m physdev -h

运行这个命令有帮助信息提示,不过很少.

dzb_01

原帖由 kong@xm 于 2006-10-20 11:36 发表



运行这个命令有帮助信息提示,不过很少.

   physdev
       This  module  matches  on  the  bridge  port  input  and output devices
       enslaved to a bridge device. This module is a part of  the  infrastruc-
       ture that enables a transparent bridging IP firewall and is only useful
       for kernel versions above version 2.5.44.

       --physdev-in name
              Name of a bridge port via which a packet is received  (only  for
              packets  entering  the INPUT, FORWARD and PREROUTING chains). If
              the interface name ends in  a  "+",  then  any  interface  which
              begins  with  this  name will match. If the packet didn't arrive
              through a bridge device, this packet won't  match  this  option,
              unless '!' is used.

       --physdev-out name
              Name  of  a  bridge  port via which a packet is going to be sent
              (for  packets  entering  the  FORWARD,  OUTPUT  and  POSTROUTING
              chains).   If  the interface name ends in a "+", then any inter-
              face which begins with this name will match. Note  that  in  the
              nat and mangle OUTPUT chains one cannot match on the bridge out-
              put port, however one can in the filter  OUTPUT  chain.  If  the
              packet  won't leave by a bridge device or it is yet unknown what
              the output device will be, then  the  packet  won't  match  this
              option, unless

       --physdev-is-in
              Matches if the packet has entered through a bridge interface.

       --physdev-is-out
              Matches if the packet will leave through a bridge interface.

       --physdev-is-bridged
              Matches  if  the  packet  is  being bridged and therefore is not
              being routed.  This is only useful in the FORWARD and  POSTROUT-
              ING chains.