webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

QoS: Do no classify as default when L7 filter isn't done

Browse Source 
We need to allow some more packets to pass through the
mangle chains so that the layer 7 filter can determine
what protocol it finds.

If L7 filter decides that a connection is of type "unknown",
we mark it as default, or it is marked with the correct class.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Michael Tremer
2019-10-22 17:48:14 +02:00
committed by Arne Fitzenreiter
parent 41c242bff8
commit d704e75d75
1 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
config/qos/makeqosscripts.pl
View File

@@ -205,9 +205,6 @@ foreach $classentry (sort @classes)
}
print <<END
### add l7-filter to PREROUTING chain to see all traffic
iptables -t mangle -A PREROUTING -m layer7 --l7proto unset
### ADD QOS-OUT CHAIN TO THE MANGLE TABLE IN IPTABLES
iptables -t mangle -N QOS-OUT
iptables -t mangle -I POSTROUTING -o $qossettings{'RED_DEV'} -j QOS-OUT
@@ -502,7 +499,7 @@ END
print <<END
### REDUNDANT: SET ALL NONMARKED PACKETS TO DEFAULT CLASS
iptables -t mangle -A QOS-INC -m mark --mark 0 -j MARK --set-mark $qossettings{'DEFCLASS_INC'}
iptables -t mangle -A QOS-INC -m mark --mark 0 -m layer7 ! --l7proto unset -j MARK --set-mark $qossettings{'DEFCLASS_INC'}
# Save mark in connection tracking
iptables -t mangle -A QOS-INC -j CONNMARK --save-mark
@@ -540,8 +537,6 @@ print <<END
iptables -t mangle --delete-chain QOS-OUT >/dev/null 2>&1
iptables -t mangle --flush QOS-INC >/dev/null 2>&1
iptables -t mangle --delete-chain QOS-INC >/dev/null 2>&1
# remove l7-filter
iptables -t mangle --delete PREROUTING -m layer7 --l7proto unset
rmmod sch_htb >/dev/null 2>&1