Configuring Traffic Counting on Victron CCGX with iptables

Key Takeaways

• The Victron Color Control GX (CCGX) can monitor network traffic using iptables commands.
• iptables rules are not persistent by default and require a script and symbolic links to survive reboots.
• Careful execution of command-line instructions is necessary to avoid system disruption.
• If you are unsure about command-line operations, contact a qualified technician.

How do you configure traffic counting on a Victron CCGX?

You configure traffic counting on a Victron Color Control GX (CCGX) by using iptables commands through its command-line interface. This process involves defining rules to categorize and count network packets for various services like VRM, remote support, and updates.

Diagnosis: Setting up iptables for traffic monitoring

The Victron Color Control GX (CCGX) supports traffic usage monitoring using iptables. This allows you to track data usage for different network services. The following steps outline the configuration process. Note that you will need to establish an SSH connection or use another method to execute these commands.

1. Clear existing iptables rules: Before adding new rules, it is good practice to clear any existing iptables configurations.

• • Execute iptables -F to flush all existing rules.
  • Execute iptables -X to delete all user-defined chains.

2. Allow local network traffic: These rules ensure that traffic within the local host and local area network (LAN) is accepted without being counted by the specific monitoring chains.

• • For local host traffic:
  • • iptables -I INPUT -s 127.0.0.0/8 -j ACCEPT
    • iptables -I OUTPUT -d 127.0.0.0/8 -j ACCEPT
  • For common LAN IP ranges:
  • • iptables -I INPUT -s 10.0.0.0/8 -j ACCEPT
    • iptables -I OUTPUT -d 10.0.0.0/8 -j ACCEPT
    • iptables -I INPUT -s 172.16.0.0/12 -j ACCEPT
    • iptables -I OUTPUT -d 172.16.0.0/12 -j ACCEPT
    • iptables -I INPUT -s 192.168.0.0/16 -j ACCEPT
    • iptables -I OUTPUT -d 192.168.0.0/16 -j ACCEPT
  • For multicast and broadcast traffic (e.g., DHCP):
  • • iptables -I INPUT -d 224.0.0.0/4 -j ACCEPT
    • iptables -I OUTPUT -d 224.0.0.0/4 -j ACCEPT
    • iptables -I INPUT -d 255.255.255.255 -j ACCEPT
    • iptables -I OUTPUT -d 255.255.255.255 -j ACCEPT

3. Create and direct traffic to custom chains: To categorize traffic, you create specific iptables chains for different services and direct relevant traffic into them. Each chain includes an ACCEPT rule to allow the traffic while counting it.

• • Generic "OTHER" traffic:
  • • iptables -N OTHER_IN (Creates a new chain for other incoming traffic.)
    • iptables -A OTHER_IN -j ACCEPT (Accepts traffic in the OTHER_IN chain.)
    • iptables -N OTHER_OUT (Creates a new chain for other outgoing traffic.)
    • iptables -A OTHER_OUT -j ACCEPT (Accepts traffic in the OTHER_OUT chain.)
    • iptables -A INPUT -g OTHER_IN (Directs remaining INPUT traffic to OTHER_IN chain.)
    • iptables -A OUTPUT -g OTHER_OUT (Directs remaining OUTPUT traffic to OTHER_OUT chain.)
  • Remote Support traffic:
  • • iptables -N REMOTE_SUPPORT_IN
    • iptables -I REMOTE_SUPPORT_IN -j ACCEPT
    • iptables -N REMOTE_SUPPORT_OUT
    • iptables -I REMOTE_SUPPORT_OUT -j ACCEPT
    • iptables -I OTHER_IN -s supporthost.victronenergy.com -g REMOTE_SUPPORT_IN
    • iptables -I OTHER_OUT -d supporthost.victronenergy.com -g REMOTE_SUPPORT_OUT
  • VRM traffic:
  • • iptables -N VRM_IN
    • iptables -I VRM_IN -j ACCEPT
    • iptables -N VRM_OUT
    • iptables -I VRM_OUT -j ACCEPT
    • iptables -I OTHER_IN -s ccgxlogging.victronenergy.com -g VRM_IN
    • iptables -I OTHER_OUT -d ccgxlogging.victronenergy.com -g VRM_OUT
  • Firmware Update traffic:
  • • iptables -N UPDATE_IN
    • iptables -I UPDATE_IN -j ACCEPT
    • iptables -N UPDATE_OUT
    • iptables -I UPDATE_OUT -j ACCEPT
    • iptables -I OTHER_IN -s updates.victronenergy.com -g UPDATE_IN
    • iptables -I OTHER_OUT -d updates.victronenergy.com -g UPDATE_OUT
  • PubNub traffic:
  • • iptables -N PUBNUB_IN
    • iptables -I PUBNUB_IN -j ACCEPT
    • iptables -N PUBNUB_OUT
    • iptables -I PUBNUB_OUT -j ACCEPT
    • iptables -I OTHER_IN -s 54.246.196.128/26 -g PUBNUB_IN
    • iptables -I OTHER_OUT -d 54.246.196.128/26 -g PUBNUB_OUT
    • iptables -I OTHER_IN -s 54.93.127.192/26 -g PUBNUB_IN
    • iptables -I OTHER_OUT -d 54.93.127.192/26 -g PUBNUB_OUT
  • NTP (Network Time Protocol) traffic:
  • • iptables -N NTP_IN
    • iptables -I NTP_IN -j ACCEPT
    • iptables -N NTP_OUT
    • iptables -I NTP_OUT -j ACCEPT
    • iptables -I OTHER_IN -p udp --sport 123 -g NTP_IN
    • iptables -I OTHER_OUT -p udp --dport 123 -g NTP_OUT
  • DNS (Domain Name System) traffic:
  • • iptables -N DNS_IN
    • iptables -I DNS_IN -j ACCEPT
    • iptables -N DNS_OUT
    • iptables -I DNS_OUT -j ACCEPT
    • iptables -I OTHER_IN -p tcp --sport domain -g DNS_IN
    • iptables -I OTHER_IN -p udp --sport domain -g DNS_IN
    • iptables -I OTHER_OUT -p tcp --dport domain -g DNS_OUT
    • iptables -I OTHER_OUT -p udp --dport domain -g DNS_OUT
  • Connman online check traffic:
  • • iptables -N CONNMAN_IN
    • iptables -I CONNMAN_IN -j ACCEPT
    • iptables -N CONNMAN_OUT
    • iptables -I CONNMAN_OUT -j ACCEPT
    • iptables -I OTHER_IN -s ipv4.connman.net -g CONNMAN_IN
    • iptables -I OTHER_OUT -d ipv4.connman.net -g CONNMAN_OUT

4. View the counted traffic data: Once the rules are in place, you can view the accumulated traffic data.

• • Execute iptables -L -x -v -n to display the rules along with packet and byte counts for each chain.

iptables Configuration Commands

This table summarizes key iptables commands used for traffic counting on the Victron Color Control GX (CCGX).

Making iptables Rules Persistent

The configuration of iptables is normally lost between reboots. To ensure your traffic counting rules persist, you need to create a script and configure it to run automatically on startup and shutdown.

1. Create the iptables script: Create a file named iptables.sh in the /etc/init.d/ directory. This script will contain all the iptables commands needed to set up your traffic counting. The script content includes the commands listed in the "Diagnosis" section and additional logic for saving and restoring counts.
2. Make the script executable: After creating the script, you must make it executable.

• • Execute chmod +x /etc/init.d/iptables.sh to grant execution permissions.

3. Configure startup and shutdown links: To ensure the iptables script runs automatically on system startup and shutdown, create symbolic links in the appropriate runlevel directories.

• • For startup (runlevel 5): ln -s /etc/init.d/iptables.sh /etc/rc5.d/S04iptables
  • For shutdown (runlevel 6): ln -s /etc/init.d/iptables.sh /etc/rc6.d/K50iptables These links tell the system to start traffic counting when the device boots and stop it gracefully, saving current counts, when it shuts down. When the traffic counting is stopped in this way, the current count values are stored together with the rules, allowing it to continue in the state it was stopped.

4. Set up automatic backup (optional but recommended): To protect your traffic counts from unexpected power outages or hard resets, you can configure a cron job to periodically back up the current rules and counts.

• • Add the following line to /etc/crontab: */10 * * * * root /etc/init.d/iptables.sh backup This cron job will execute the backup function of your iptables.sh script every 10 minutes, saving the current state of your traffic counters.

Safety: Command-line operations

Working with the command line on your Victron CCGX requires careful attention. Incorrect commands can disrupt network connectivity, system monitoring, or even render the device inaccessible. Always double-check commands before execution. There are no specific electrical hazards related to iptables configuration itself, but general electrical safety practices should always be followed when working with solar power systems.

When to call a technician instead

If you are unfamiliar with Linux command-line operations, iptables syntax, or network configuration, it is best to consult a qualified Victron Energy installer or technician. Incorrectly configured iptables rules can lead to loss of internet connectivity, prevent data from reaching the VRM portal, or cause other system malfunctions. A technician can ensure the configuration is applied correctly and troubleshoot any issues that arise.