We need to allow some more packets to pass through the mangle chains so that the layer 7 filter can determine what protocol it finds.
If L7 filter decides that a connection is of type "unknown", we mark it as default, or it is marked with the correct class.
Signed-off-by: Michael Tremer michael.tremer@ipfire.org --- config/qos/makeqosscripts.pl | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/config/qos/makeqosscripts.pl b/config/qos/makeqosscripts.pl index 1a5d01d52..cbbbf70f8 100644 --- a/config/qos/makeqosscripts.pl +++ b/config/qos/makeqosscripts.pl @@ -205,9 +205,6 @@ foreach $classentry (sort @classes) } print <<END
- ### add l7-filter to PREROUTING chain to see all traffic - iptables -t mangle -A PREROUTING -m layer7 --l7proto unset - ### ADD QOS-OUT CHAIN TO THE MANGLE TABLE IN IPTABLES iptables -t mangle -N QOS-OUT iptables -t mangle -I POSTROUTING -o $qossettings{'RED_DEV'} -j QOS-OUT @@ -502,7 +499,7 @@ END
print <<END ### REDUNDANT: SET ALL NONMARKED PACKETS TO DEFAULT CLASS - iptables -t mangle -A QOS-INC -m mark --mark 0 -j MARK --set-mark $qossettings{'DEFCLASS_INC'} + iptables -t mangle -A QOS-INC -m mark --mark 0 -m layer7 ! --l7proto unset -j MARK --set-mark $qossettings{'DEFCLASS_INC'}
# Save mark in connection tracking iptables -t mangle -A QOS-INC -j CONNMARK --save-mark @@ -540,8 +537,6 @@ print <<END iptables -t mangle --delete-chain QOS-OUT >/dev/null 2>&1 iptables -t mangle --flush QOS-INC >/dev/null 2>&1 iptables -t mangle --delete-chain QOS-INC >/dev/null 2>&1 - # remove l7-filter - iptables -t mangle --delete PREROUTING -m layer7 --l7proto unset
rmmod sch_htb >/dev/null 2>&1