multicast в iptables (Как настроить ))

[alukar4eg]

Вообщем друзья есть такая задача .
Провайдер даёт IPTV
У Меня дома стоит линух Шлюз на Дебиане Ленни

Собственно посмотреть его ну никак не получается .. (((
В скрипт добавил
$IPT -A INPUT -p ALL -d 239.0.0.0/255.0.0.0 -j ACCEPT
$IPT -A FORWARD -p ALL -d 239.0.0.0/255.0.0.0 -j ACCEPT

Но всё равно ничерта не работает . Куда Смотреть ??

Длаее к этому всему дело с работы я подключаюсь по VPN на шлюзе стоит pptpd , хочется ТВ смотреть и на Работе через VPN ))

[KiWi]

igmpproxy

[alukar4eg]

А без него никак нельзя ??? ))

[alukar4eg]

Код: Выделить всё

igmpproxy -d ./igmpproxy.conf
MRT_ADD_MEMBERSHIP failed; Errno(98): Address already in use
The source address 10.15.1.4 for group 239.102.0.14, is not in any valid net for upstream VIF.

Столкнулся с такой проблемой , конфиг igmpproxy

Код: Выделить всё

##------------------------------------------------------
## Enable Quickleave mode (Sends Leave instantly)
##------------------------------------------------------
quickleave


##------------------------------------------------------
## Configuration for eth0 (Upstream Interface)
##------------------------------------------------------
phyint eth0 upstream  ratelimit 0  threshold 1
        altnet 10.0.0.0/4
        #altnet 192.168.0.0/24
        altnet 239.0.0.0/8

##------------------------------------------------------
## Configuration for eth1 (Downstream Interface)
##------------------------------------------------------
phyint eth2 downstream  ratelimit 0  threshold 1


##------------------------------------------------------
## Configuration for eth2 (Disabled Interface)
##------------------------------------------------------
#phyint eth2 disabled

[alukar4eg]

вот на данный момент такой лог

igmpproxy -d ./igmpproxy.conf

Код: Выделить всё

The source address 10.15.1.5 for group 239.103.2.3, is not in any valid net for upstream VIF.
The source address 10.15.1.3 for group 239.101.0.3, is not in any valid net for upstream VIF.
The source address 10.15.1.2 for group 239.100.0.2, is not in any valid net for upstream VIF.
The source address 10.15.1.4 for group 239.102.2.5, is not in any valid net for upstream VIF.
The source address 10.15.1.5 for group 239.103.3.9, is not in any valid net for upstream VIF.
The source address 10.15.1.3 for group 239.101.0.2, is not in any valid net for upstream VIF.
The source address 10.15.1.5 for group 239.103.1.1, is not in any valid net for upstream VIF.
The source address 10.15.1.5 for group 239.103.3.9, is not in any valid net for upstream VIF.
The source address 10.15.1.4 for group 239.102.2.2, is not in any valid net for upstream VIF.
The source address 10.15.1.4 for group 239.102.2.6, is not in any valid net for upstream V

iptables-save

Код: Выделить всё

# Generated by iptables-save v1.4.4 on Wed Oct 14 18:02:29 2009
*nat
:PREROUTING ACCEPT [17337:19786067]
:POSTROUTING ACCEPT [3:345]
:OUTPUT ACCEPT [539:32556]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Oct 14 18:02:29 2009
# Generated by iptables-save v1.4.4 on Wed Oct 14 18:02:29 2009
*mangle
:PREROUTING ACCEPT [91736:53312548]
:INPUT ACCEPT [7037917:1206022793]
:FORWARD ACCEPT [8740607:6266265846]
:OUTPUT ACCEPT [49935:16908084]
:POSTROUTING ACCEPT [18703569:16257522654]
-A PREROUTING -d 239.0.0.0/8 -p udp -j TTL --ttl-inc 1
-A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Oct 14 18:02:29 2009
# Generated by iptables-save v1.4.4 on Wed Oct 14 18:02:29 2009
*filter
:INPUT DROP [1208:77116]
:FORWARD DROP [12:661]
:OUTPUT DROP [11:1650]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -p gre -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 239.0.0.0/8 -j ACCEPT
-A INPUT -d 239.0.0.0/8 -i eth0 -j ACCEPT
-A INPUT -s 239.0.0.0/8 -i eth0 -j ACCEPT
-A INPUT -s 192.168.10.0/24 -i eth2 -j ACCEPT
-A INPUT -d 192.168.10.255/32 -i eth2 -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -j tcp_inbound
-A INPUT -i eth0 -p udp -j udp_inbound
-A INPUT -i eth0 -p icmp -j icmp_packets
-A INPUT -m pkttype --pkt-type broadcast -j ACCEPT
-A INPUT -i eth2 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "INPUT packet died: "
-A FORWARD -d 239.0.0.0/8 -j ACCEPT
-A FORWARD -d 239.0.0.0/8 -j ACCEPT
-A FORWARD -s 239.0.0.0/8 -j ACCEPT
-A FORWARD -j bad_packets
-A FORWARD -o eth2 -p tcp -j ACCEPT
-A FORWARD -i eth2 -p tcp -j tcp_outbound
-A FORWARD -o ppp0 -p tcp -j ACCEPT
-A FORWARD -i ppp0 -p tcp -j tcp_outbound
-A FORWARD -i eth2 -p udp -j udp_outbound
-A FORWARD -i ppp0 -p udp -j udp_outbound
-A FORWARD -i eth2 -j ACCEPT
-A FORWARD -i ppp0 -j ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "FORWARD packet died: "
-A FORWARD -d 192.168.10.234/32 -i eth0 -p udp -m udp --dport 16934 -j ACCEPT
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 192.168.10.1/32 -j ACCEPT
-A OUTPUT -o eth2 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "OUTPUT packet died: "
-A bad_packets -s 192.168.10.0/24 -i eth0 -j LOG --log-prefix "Illegal source: "
-A bad_packets -s 192.168.10.0/24 -i eth0 -j DROP
-A bad_packets -m state --state INVALID -j LOG --log-prefix "Invalid packet: "
-A bad_packets -m state --state INVALID -j DROP
-A bad_packets -p tcp -j bad_tcp_packets
-A bad_packets -j RETURN
-A bad_tcp_packets -i eth2 -p tcp -j RETURN
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn: "
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A bad_tcp_packets -p tcp -j RETURN
-A icmp_packets -p icmp -f -j LOG --log-prefix "ICMP Fragment: "
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 443 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 411 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 6890 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 6891 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 1723 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -p udp -m udp --dport 137 -j DROP
-A udp_inbound -p udp -m udp --dport 138 -j DROP
-A udp_inbound -p udp -j RETURN
-A udp_inbound -p udp -m udp --dport 6890 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 6891 -j ACCEPT
-A udp_outbound -p udp -j ACCEPT
COMMIT