1

My intention is to monitor traffic from/to wan. To achieve that, i want to calculate outgoing and ingoing bytes/second, with iptables counters as data source. Unluckily, I'm not able to understand what to do with FORWARD chain, although I'm aware of INPUT and OUTPUT. I'm focusing on iptables because it actually shows only IPV4 packets and bytes since I don't need Ethernet ones. My configuration scheme is: modem -> OpenWrt router

And here's my /etc/config/firewall file:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config forwarding
        option dest 'wan'
        option src 'lan'

If possible, please provide me an answer that works also with OpenWrt-based access points, not only routers. Thank you!

Improve this question

1 Answer 1

Reset to default
1

I'll guess that openwrt routers have a full blown iptables command. If so, then the question becomes as easy as parsing the iptables traffic counters.

As an example, let's assume that I am keen on measuring traffic to the GoogleDNS server 8.8.8.8 on a vanilla server that has no iptables rules as seen below

  ❯❯❯ sudo iptables -n -L -xv 
Chain INPUT (policy ACCEPT 27 packets, 1660 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 21 packets, 2132 bytes)
    pkts      bytes target     prot opt in     out     source               destination

As you can see, we have global per chain packet counters (Example: Output has seen 21 packets of 2132 bytes)

Next step, we inject a rule for the traffic we are interested in. In this example, we'll ask iptables to watch out for all traffic to 8.8.8.8

❯❯❯ sudo iptables -I OUTPUT 1 -o eth0 -d 8.8.8.8

Let's see what the packet accounting counters report (note the new rule for 8.8.8.8 is now listed)

  ❯❯❯ sudo iptables -n -L -xv
Chain INPUT (policy ACCEPT 12 packets, 752 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 8 packets, 784 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0            all  --  *      eth0    0.0.0.0/0            8.8.8.8

Let's generate 5 ICMP request packets.

  ❯❯❯ ping -c 5 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=128 time=159 ms
64 bytes from 8.8.8.8: icmp_req=2 ttl=128 time=159 ms
64 bytes from 8.8.8.8: icmp_req=3 ttl=128 time=156 ms
64 bytes from 8.8.8.8: icmp_req=4 ttl=128 time=161 ms
64 bytes from 8.8.8.8: icmp_req=5 ttl=128 time=155 ms

--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4010ms
rtt min/avg/max/mdev = 155.294/158.503/161.081/2.092 ms

Taking a look at the iptables counters, we'll see that we recorded the packet count and byte count for the outgoing packets to 8.8.8.8

  ❯❯❯ sudo iptables -n -L -xv 
Chain INPUT (policy ACCEPT 105 packets, 6900 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 67 packets, 6956 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       5      420            all  --  *      eth0    0.0.0.0/0            8.8.8.8

Note that the bytes were (64 bytes/ICMP request + 20 bytes/IP request) * 5 requests :)

If you want to monitor incoming traffic from that server, you'll just add an INPUT rule for it (Hint: just change output => input).

Now that you know the basics, you can go crazy and divvy up your traffic by

  • Protocol (udp vs tcp vs icmp)
  • Subnets (You use this to give to differentiate Intra-network bandwidth (within the datacenter) vs external traffic)

    ...

Improve this answer
5
  • OK, very clear answer. But I still have a doubt: INPUT chain is for data with my device as destination, and OUTPUT is for data with my device as source. iptables, however, does not differentiate FORWARD data in input and output. Is it correct to assume that X bytes have been both downloaded and uploaded? Commented Jun 22, 2015 at 19:03
  • If your device is routing or NAT-ing, then you'll see the forward chain counters increment because packets will be traversing this chain. Remember that you can put a source and destination parameter to the forward chain rules to distinguish between LAN egress vs LAN ingress traffic.. See this article for an in-depth explanation: linux.com/learn/tutorials/… Commented Jun 22, 2015 at 19:58
  • @LivingSilver94, could you add in your exact setup and what you'd like to achieve? It might be easier to work out a solution with these facts at hand. :) Commented Jun 22, 2015 at 19:59
  • I've edited my question. Hope it helps. I'll also read you article. A big thank you meanwhile ;) Commented Jun 23, 2015 at 11:38
  • Oh and also, what are my FORWARD destination and source supposed to be? Router's IP? Or the first hop outside my network? Commented Jun 23, 2015 at 13:12

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.