On 12/13/2013 7:53 AM, Davide Ferri wrote: > Hi all, > I'm tring to convert some manually written iptables rules into a > shorewall configuration but I'm facing some issue with mode statistic. > In our outgoing smtp we balance the source IP address of outgoing > connections originating from the firewall between 4 alias configured on > eth0 interface: > > eth0 inet addr:xxx.xxx.xxx.18 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0 > eth0:1 inet addr:xxx.xxx.xxx.19 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0 > eth0:2 inet addr:xxx.xxx.xxx.28 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0 > eth0:3 inet addr:xxx.xxx.xxx.29 Bcast:xxx.xxx.xxx.255 Mask:255.255.255.0 > > using iptables we just add the following rules: > > iptables -A POSTROUTING -m statistic --mode random --probability 0.25 -t > nat -o eth0 -p tcp --dport 25 -j SNAT --to xxx.xxx.xxx.19 > iptables -A POSTROUTING -m statistic --mode random --probability 0.33 -t > nat -o eth0 -p tcp --dport 25 -j SNAT --to xxx.xxx.xxx.28 > iptables -A POSTROUTING -m statistic --mode random --probability 0.5 -t > nat -o eth0 -p tcp --dport 25 -j SNAT --to xxx.xxx.xxx.29 > > how can we achieve this with shorewall ?
The only way to do it with current Shorewall versions is to insert those rules using your 'start' extension script. Beginning with Shorewall 4.6.0, you will be able to do something like the following in /etc/shorewall/masq: INLINE(eth0) - xxx.xxx.xxx.19 tcp 25 ; -m statistic --mode random --probablilty 0.25 ... The attached patch can be applied to recent Shorewall 4.5 versions to allow you do do that now. patch /usr/share/shorewall/Shorewall/Nat.pm < INLINEMASQ.patch That command assumes that PERLLIB=/usr/share/shorewall/ in your shorewallrc file. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
diff --git a/Shorewall/Perl/Shorewall/Nat.pm b/Shorewall/Perl/Shorewall/Nat.pm
index c88c2ef..d328ab3 100644
--- a/Shorewall/Perl/Shorewall/Nat.pm
+++ b/Shorewall/Perl/Shorewall/Nat.pm
@@ -66,12 +66,20 @@ sub process_one_masq1( $$$$$$$$$$ )
my $add_snat_aliases = $family == F_IPV4 && $config{ADD_SNAT_ALIASES};
my $destnets = '';
my $baserule = '';
+ my $inlinematches = '';
#
# Leading '+'
#
$pre_nat = 1 if $interfacelist =~ s/^\+//;
#
+ # Check for INLINE
+ #
+ if ( $interfacelist =~ /^INLINE\((.+)\)$/ ) {
+ $interfacelist = $1;
+ $inlinematches = get_inline_matches;
+ }
+ #
# Parse the remaining part of the INTERFACE column
#
if ( $family == F_IPV4 ) {
@@ -325,7 +333,7 @@ sub process_one_masq1( $$$$$$$$$$ )
expand_rule( $chainref ,
POSTROUTE_RESTRICT ,
'' ,
- $baserule . $rule ,
+ $baserule . $inlinematches . $rule ,
$networks ,
$destnets ,
$origdest ,
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Rapidly troubleshoot problems before they affect your business. Most IT organizations don't have a clear picture of how application performance affects their revenue. With AppDynamics, you get 100% visibility into your Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro! http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
