Classification to tc structure example - Revision history

Vaclavz at 07:40, 16 April 2019

2019-04-16T07:40:30Z

← Older revision		Revision as of 07:40, 16 April 2019
Line 17:		Line 17:
	** '''meta priority set ip daddr map @group_114_prio''' - sets priority to packet based on its destination address, which is read from map named group_114_prio - sets priority to 1:ffd9		** '''meta priority set ip daddr map @group_114_prio''' - sets priority to packet based on its destination address, which is read from map named group_114_prio - sets priority to 1:ffd9

	=== ~~Basic prototype -~~ tc class structure ===		== Basic prototypes ==
			=== tc class structure ===
	<source lang="bash">		<source lang="bash">
	+---(1:) hfsc		+---(1:) hfsc
Line 36:		Line 37:
	</source>		</source>

	=== ~~Basic prototype -~~ tc qdisc structure ===		=== tc qdisc structure ===
	<source lang="bash">		<source lang="bash">
	qdisc hfsc 1: root refcnt 2 default 2		qdisc hfsc 1: root refcnt 2 default 2
Line 47:		Line 48:
	</source>		</source>

	=== ~~Basic prototype -~~ nftables structure ===		=== nftables structure ===

	table ip filter {		table ip filter {
Line 107:		Line 108:
	}		}

	=== ~~Basic~~ nftables commands ===		=== nftables commands ===
	* executed using '''nft -f filename.nft''' - or using function ''nft_run_cmd_from_buffer'' - libnftables		* executed using '''nft -f filename.nft''' - or using function ''nft_run_cmd_from_buffer'' - libnftables
	<source>		<source>

Vaclavz: /* Additional documentations and articles */

2019-04-16T07:20:45Z

Additional documentations and articles

← Older revision		Revision as of 07:20, 16 April 2019
Line 195:		Line 195:
	'''}'''		'''}'''

	= Additional documentations and articles =		== Additional documentations and articles ==
	* this article can help a lot during definition of redesigned rule structure, it shows performance with different setup of rules, yet it tels almost nothing about classification itself		* this article can help a lot during definition of redesigned rule structure, it shows performance with different setup of rules, yet it tels almost nothing about classification itself
	* https://developers.redhat.com/blog/2017/04/11/benchmarking-nftables/		* https://developers.redhat.com/blog/2017/04/11/benchmarking-nftables/

Vaclavz: /* Packet processing */

2019-04-16T07:20:34Z

Packet processing

← Older revision		Revision as of 07:20, 16 April 2019
Line 147:		Line 147:

	== Packet processing ==		== Packet processing ==
	* '''chain forward~~'''~~		=== chain forward ===
	# packet passing through server		# packet passing through server
	'''chain forward {'''		'''chain forward {'''
Line 167:		Line 167:
	'''}'''		'''}'''

	* '''chain group_114~~'''~~		=== chain group_114 ===
	# subnet_map redirected the packet here		# subnet_map redirected the packet here
	'''chain group_114 {'''		'''chain group_114 {'''

Vaclavz: /* Packet processing */

2019-04-16T07:20:09Z

Packet processing

← Older revision		Revision as of 07:20, 16 April 2019
Line 146:		Line 146:
	</source>		</source>

	= Packet processing =		== Packet processing ==
	* '''chain forward'''		* '''chain forward'''
	# packet passing through server		# packet passing through server

Vaclavz: /* Basic nftables commands */

2019-04-16T07:20:00Z

Basic nftables commands

← Older revision		Revision as of 07:20, 16 April 2019
Line 107:		Line 107:
	}		}

	= Basic nftables commands =		=== Basic nftables commands ===
	* executed using '''nft -f filename.nft''' - or using function ''nft_run_cmd_from_buffer'' - libnftables		* executed using '''nft -f filename.nft''' - or using function ''nft_run_cmd_from_buffer'' - libnftables
	<source>		<source>

Vaclavz: /* Basic prototype - nftables structure */

2019-04-16T07:19:50Z

Basic prototype - nftables structure

← Older revision		Revision as of 07:19, 16 April 2019
Line 47:		Line 47:
	</source>		</source>

	= Basic prototype - nftables structure =		=== Basic prototype - nftables structure ===

	table ip filter {		table ip filter {

Vaclavz: /* Basic prototype - tc qdisc structure */

2019-04-16T07:19:40Z

Basic prototype - tc qdisc structure

← Older revision		Revision as of 07:19, 16 April 2019
Line 36:		Line 36:
	</source>		</source>

	= Basic prototype - tc qdisc structure =		=== Basic prototype - tc qdisc structure ===
	<source lang="bash">		<source lang="bash">
	qdisc hfsc 1: root refcnt 2 default 2		qdisc hfsc 1: root refcnt 2 default 2

Vaclavz: /* Basic prototype - tc class structure */

2019-04-16T07:19:29Z

Basic prototype - tc class structure

← Older revision		Revision as of 07:19, 16 April 2019
Line 17:		Line 17:
	** '''meta priority set ip daddr map @group_114_prio''' - sets priority to packet based on its destination address, which is read from map named group_114_prio - sets priority to 1:ffd9		** '''meta priority set ip daddr map @group_114_prio''' - sets priority to packet based on its destination address, which is read from map named group_114_prio - sets priority to 1:ffd9

	= Basic prototype - tc class structure =		=== Basic prototype - tc class structure ===
	<source lang="bash">		<source lang="bash">
	+---(1:) hfsc		+---(1:) hfsc

Vaclavz: /* Introduction */

2019-04-16T07:19:17Z

Introduction

← Older revision		Revision as of 07:19, 16 April 2019
Line 1:		Line 1:
	= Introduction =		== Introduction ==
	* '''nftables''' can replace not even ''iptables'', but it can be used to replace very poorly documented ''tc filter'' rules and allow user to classify packets into tc class / qdisc infrastructure.		* '''nftables''' can replace not even ''iptables'', but it can be used to replace very poorly documented ''tc filter'' rules and allow user to classify packets into tc class / qdisc infrastructure.
	* There is also support for sets and maps (with much cleaner and more intuitive behavior than in tc filter), which has very good impact on performance in large filtering structures, because they use hashing to get correct value.		* There is also support for sets and maps (with much cleaner and more intuitive behavior than in tc filter), which has very good impact on performance in large filtering structures, because they use hashing to get correct value.

Vaclavz: /* Introduction */

2019-04-16T07:19:06Z

Introduction

← Older revision		Revision as of 07:19, 16 April 2019
Line 6:		Line 6:
	* Note that, unlike ''iptables'' or '''tc filter''', you can perform several actions in one single rule and match several informations - counter is must have for debugging		* Note that, unlike ''iptables'' or '''tc filter''', you can perform several actions in one single rule and match several informations - counter is must have for debugging
	* You will have to redesign your rule structure to benefit from these new nice features.		* You will have to redesign your rule structure to benefit from these new nice features.
	'''example''':		* '''example''':

	meta priority none ip saddr @priority_set meta priority set ip daddr map @group_114_prio counter packets 0 bytes 0		meta priority none ip saddr @priority_set meta priority set ip daddr map @group_114_prio counter packets 0 bytes 0

	packet:		* packet:
	source address 8.8.8.8		** source address 8.8.8.8
	destination address 10.20.255.50		** destination address 10.20.255.50
	* '''meta priority none''' - matches packet only when there is no priority - tc class id - set yet		** '''meta priority none''' - matches packet only when there is no priority - tc class id - set yet
	* '''ip saddr @priority_set''' - matches packet only when source IP address is listed in the set named priority_set - in our case 8.8.8.8 or 8.8.4.4 - can be subnet too		** '''ip saddr @priority_set''' - matches packet only when source IP address is listed in the set named priority_set - in our case 8.8.8.8 or 8.8.4.4 - can be subnet too
	* '''meta priority set ip daddr map @group_114_prio''' - sets priority to packet based on its destination address, which is read from map named group_114_prio - sets priority to 1:ffd9		** '''meta priority set ip daddr map @group_114_prio''' - sets priority to packet based on its destination address, which is read from map named group_114_prio - sets priority to 1:ffd9

	= Basic prototype - tc class structure =		= Basic prototype - tc class structure =