Help with Mangle

cpelect · Fri Dec 15, 2006 7:52 pm

I've been using the Mangle rules that were posted on the Microtik wiki site and I think I have them set up properly for use with the hotspot, except that I it doesn't seem to show usage for downloading from the internet. I assumed that it would show up in HTTP traffic, but it doesn't. Is there a Mangle rule that I need to build that handles HTTP downloading?

Here are the rules I have and how they are configured.

 0   chain=prerouting dst-address-list=nat-addr action=mark-packet 
     new-packet-mark=nat-traversal passthrough=no 

 1   chain=prerouting src-address=10.10.10.0/24 protocol=tcp 
     connection-state=new action=jump jump-target=tcp-services 

 2   chain=prerouting src-address=10.10.10.0/24 protocol=udp 
     connection-state=new action=jump jump-target=udp-services 

 3   chain=prerouting src-address=10.10.10.0/24 connection-state=new 
     action=jump jump-target=other-services 

 4   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=20-21 action=mark-connection 
     new-connection-mark=ftp passthrough=no 

 5   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=513-65535 dst-port=22 action=mark-connection 
     new-connection-mark=ssh passthrough=no 

 6   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=23 action=mark-connection 
     new-connection-mark=telnet passthrough=no 

 7   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=25 action=mark-connection 
     new-connection-mark=smtp passthrough=no 

 8   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp src-port=53 
     dst-port=53 action=mark-connection new-connection-mark=dns 
     passthrough=no 

 9   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=53 action=mark-connection 
     new-connection-mark=dns passthrough=no 

10   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=80 connection-state=new 
     action=mark-connection new-connection-mark=http passthrough=no 

11   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=110 action=mark-connection 
     new-connection-mark=pop3 passthrough=no 

12   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=113 action=mark-connection 
     new-connection-mark=auth passthrough=no 

13   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=119 action=mark-connection 
     new-connection-mark=nntp passthrough=no 

14   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=143 action=mark-connection 
     new-connection-mark=imap passthrough=no 

15   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=161-162 action=mark-connection 
     new-connection-mark=snmp passthrough=no 

16   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=443 action=mark-connection 
     new-connection-mark=https passthrough=no 

17   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=465 action=mark-connection 
     new-connection-mark=smtps passthrough=no 

18   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=993 action=mark-connection 
     new-connection-mark=imaps passthrough=no 

19   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=995 action=mark-connection 
     new-connection-mark=pop3s passthrough=no 

20   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=1723 action=mark-connection 
     new-connection-mark=pptp passthrough=no 

21   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=2379 action=mark-connection 
     new-connection-mark=kgs passthrough=no 

22   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=3128 action=mark-connection 
     new-connection-mark=proxy passthrough=no 

23   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=3987 action=mark-connection 
     new-connection-mark=win-ts passthrough=no 

24   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=4242-4243 action=mark-connection 
     new-connection-mark=emule passthrough=no 

25   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=4661-4662 dst-port=1024-65535 action=mark-connection 
     new-connection-mark=overnet passthrough=no 

26   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp src-port=4711 
     dst-port=1024-65535 action=mark-connection new-connection-mark=emule 
     passthrough=no 

27   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=5900-5901 action=mark-connection 
     new-connection-mark=vnc passthrough=no 

28   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=6667-6669 action=mark-connection 
     new-connection-mark=irc passthrough=no 

29   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=6881-6889 action=mark-connection 
     new-connection-mark=bittorrent passthrough=no 

30   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=8080 action=mark-connection 
     new-connection-mark=http passthrough=no 

31   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     src-port=1024-65535 dst-port=8291 action=mark-connection 
     new-connection-mark=winbox passthrough=no 

32   chain=tcp-services src-address=10.10.10.0/24 protocol=tcp 
     action=mark-connection new-connection-mark=other-tcp passthrough=no 

33   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     src-port=1024-65535 dst-port=53 action=mark-connection 
     new-connection-mark=dns passthrough=no 

34   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     src-port=1024-65535 dst-port=123 action=mark-connection 
     new-connection-mark=ntp passthrough=no 

35   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     src-port=1024-65535 dst-port=1701 action=mark-connection 
     new-connection-mark=l2tp passthrough=no 

36   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     src-port=1024-65535 dst-port=4665 action=mark-connection 
     new-connection-mark=emule passthrough=no 

37   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     src-port=1024-65535 dst-port=4672 action=mark-connection 
     new-connection-mark=emule passthrough=no 

38   chain=udp-services src-address=10.10.10.0/24 protocol=udp src-port=4672 
     dst-port=1024-65535 action=mark-connection new-connection-mark=emule 
     passthrough=no 

39   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     src-port=1024-65535 dst-port=12053 action=mark-connection 
     new-connection-mark=overnet passthrough=no 

40   chain=udp-services src-address=10.10.10.0/24 protocol=udp src-port=12053 
     dst-port=1024-65535 action=mark-connection new-connection-mark=overnet 
     passthrough=no 

41   chain=udp-services src-address=10.10.10.0/24 protocol=udp src-port=36725 
     dst-port=1024-65535 action=mark-connection new-connection-mark=skype 
     passthrough=no 

42   chain=udp-services src-address=10.10.10.0/24 protocol=udp 
     connection-state=new action=mark-connection 
     new-connection-mark=other-udp passthrough=no 

43   chain=other-services src-address=10.10.10.0/24 protocol=icmp 
     icmp-options=8:0-255 action=mark-connection new-connection-mark=ping 
     passthrough=no 

44   chain=other-services src-address=10.10.10.0/24 protocol=gre 
     action=mark-connection new-connection-mark=gre passthrough=no 

45   chain=other-services src-address=10.10.10.0/24 action=mark-connection 
     new-connection-mark=other passthrough=no

Also, any other pointers that would help me track the traffic going through this box would be great.

Edit: All the traffic that I can't see in my mangle rules do show up in the very first rule that is defined as "nat-traversal". (rule 0)

cpelect · Tue Dec 19, 2006 8:20 pm

Anybody?