Home/ Questions/Q 7403709
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T05:08:59+00:00

Im writing a bash scripting to account traffic in my network server: WAN:eth1 ->

  • 0

Im writing a bash scripting to account traffic in my network server:

WAN:eth1 -> GNU/Linux Server:eth0 -> Users
The GNU/Linux server uses squid, bind, QoS, mysql, lighttpd.

After an IP exceed the established quota a new QoS rule is applied for that IP (user) too exist one “flag” to decide when is restored the IP counter to Zero.

Some IPs and subnets work without quotas, other gruop of ips/subnets work with new QoS after quota is exceeded, and now I wanna work with a third group with redirection after quota is exceeded.

When an IP exceed the established quota all http traffic must be redirected to host (lighttpd runing on GNU/Linux ) and DROP all other traffic generated for that IP. In webserver exist a webpage with: “You exceed your daily quote of traffic, please wait “x” hours or call to your provider to purchase an extra navigation package” or something like that.

Is possible using a chain, or how can I do that?.
The most topics that I found in Internet, are related to block all and create a new chain to let out to Internet (not work for me). And other redirect only IP by IP, but how can I create something that a “chain” and attach the IPs to must me redirected to can after restore that IPs easly?

Thanks for help and sorry for my poor English :S.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Are you looking for something like this?

    iptables -t nat -A PREROUTING -s 192.168.100.66 -p tcp --dport 80 -j REDIRECT --to-ports 80
iptables -I INPUT 1 -i lo -s 192.168.100.66 -j ACCEPT
iptables -I INPUT 2 -i eth1 -d 192.168.100.66 -j DROP

    This will redirect packets from 192.168.100.66 on port 80 to the local webserver on the loopback interface, allow that conversation, then reject all other packets being routed to 192.168.100.66 on the WAN interface.

    To restore the connection back to normal you will want to delete those firewall entries:

    iptables -t nat -D PREROUTING -s 192.168.100.66 -p tcp --dport 80 -j REDIRECT --to-ports 80
iptables -D INPUT -i lo -s 192.168.100.66 -j ACCEPT
iptables -D INPUT -i eth1 -d 192.168.100.66 -j DROP
    • 0