http://wiki.mikrotik.com/wiki/Packet_Flow http://mum.mikrotik.com/presentations/US09/megis_qos.pdf 简单说: 设备-有两个端口WAN 和 LAN ，而flow基本上都是成对的 A. 当一个packet从 WAN端进入forward会经过哪些table? in-interface=WAN → preroute →global-in →Mangle forward →Mangle postroute →globan-out → out-interface = LAN *也就是这封包会同时经过 1.glob-in/global out 2.preroute 3.forward 4.in-interface=WAN/out-interface = LAN B. 当一个packet从Lan端进入会经过哪些tables? in-interface=LAN → preroute →global-in →Mangle forward →Mangle postroute →globan-out → out-interface = WAN 1.glob-in/global out 2.preroute 3.forward 4.in-interface=LAN/out-interface = WAN C. 问题1是: 如果 /ip firewall mamgle add chain=forward action=mark-packet src-address=192.168.0.0/24 proto=tcp port=80 new-packet-mark=tcp_up (我要queue tree作用在global中~该选global-in 还 glob-out呢?) 问题2是: /ip firewall mamgle add chain=preroute action=mark-packet src-address=192.168.0.0/24 port=80 new-packet-mark=tcp_up (我要queue tree作用在global中~该选global-in 还 glob-out呢?) 问题3是: 如果 /ip firewall mamgle add chain=forward action=mark-packet src-address=192.168.0.0/24 proto=tcp port=80 new-packet-mark=tcp_up (我要queue tree作用在interface中~该选WAN 还 LAN呢?) 问题4是: 如果 /ip firewall mamgle add chain=preroute action=mark-packet src-address=192.168.0.0/24 proto=tcp port=80 new-packet-mark=tcp_up (我要queue tree作用在interface中~该选WAN 还 LAN呢?) 问题5是: interface=local是指啥呢? 指interface address ip是local的interface? -- 2011/06/13补充 A.如果要标记一个上传封包可以用下面方式(同问题四) /ip firewall mangle add chain=preroute action=mark-packet src-address=192.168.0.0/24 new-packet-mark=src_mark -而且只有用在"出口"端才有效 B.如果要标记下载封包则要怎标记呢? /ip firewall mangle add chain=forward action=mark-packet dst-address=192.168.0.0/24 new-packet-mark=dst_mark C.你或许会想说那是不是要上下传都标记一次?其实有其他法 /ip firewall mangle add chain=preroute action=mark-connection src-address=192.168.0.0/24 new-connection=src_con add chain=preroute action=mark-packet connection-mark=src_con new-packet-mark=src_mark -用在wan端会发现可以控制上传 -用在lan端会发现可以控制下载 -(1).为何上下传都可以控制呢? 根据TCP交握，发起端是192.168.0.0/24，从外面又回到发起的pc是一条线，而整条线的 封包都被mark了! -(2).为何用在wan会变成控制上传，lan会下载呢? 根据之前所说的会成为这张图，http://0rz.tw/yHFTY， 由下往上看， 进入网卡後→开始追踪连结→才经过prerouting→又经过dnat→然後global-in→ forward→postrouting→global-out→snat→最後才到interface 因为流量管控一律是出口的interface D.为何不直接用 prerouting dst-192.168.0.0/24的packet，呢? -根据http://0rz.tw/yHFTY，会发现外部封包回来经过preroute表的时候，dst没有 dst-192.168.0.0/24，但是会发现经过dnat，进入forward前会变成区网ip，所以可 以标记forward链表! E.那为何标记连线不用preroute dst-192.168.0.0/24的connection呢? -因为下载连线追踪是发生在snat之前，所以不会有dst-192.168.0.0/24的连线， 但是换成forward dst-192.168.0.0/24的connection 则可以! F.假设标记forward dst-192.168.0.0/24 connection该怎使用? -(1) /ip firewall mangle add chain=forward action=new-connection-mark dst-address=192.168.0.0/24 new-connection-mark=dst_con add chain=forward action=new-packet-mark connection-mark=dst_con new-packet-mark=dst_ogc -(2) /ip firewall mangle add chain=forward action=new-connection-mark dst-address=192.168.0.0/24 new-connection-mark=dst_con passthrough=yes add chain=forward action=new-packet-mark connection-mark=dst_con dst-address=192.168.0.0/24 new-packet-mark=dst_ogc passthrough=no add chain=forward action=new-packet-mark connection-mark=dst_con src-address=192.168.0.0/24 new-packet-mark=dst_ogc passthrough=no -(3) /ip firewall mangle add chain=forward action=new-connection-mark dst-address=192.168.0.0/24 new-connection-mark=dst_con passthrough=yes add chain=forward action=new-packet-mark connection-mark=dst_con dst-address=192.168.0.0/24 new-packet-mark=dst_ogc passthrough=no add chain=preroute action=new-packet-mark connection-mark=dst_con src-address=192.168.0.0/24 new-packet-mark=dst_ogc passthrough=no --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 203.72.144.90 ※ 编辑: kingofsdtw 来自: 203.72.144.93 (06/13 23:27)