LARTC - Feb 2001 - Incoming trafic shaping (depending on src IP)

Hi there,


i''m trying to shape incoming trafic on my linux box.

I want it to depend on the source IP adress of the packets (in fact, i got 
a VPN on an ADSL link and wanted to get at least/max 64Kbit/s for the VPN)

So i tried this :

tc qdisc add dev ppp0 root handle 1:0 cbq bandwidth 512Kbit avpkt 1000 cell 8
tc class add dev ppp0 parent 1:0 classid 1:1 cbq bandwidth 512Kbit rate 
512Kbit weight 50Kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
tc class add dev ppp0 parent 1:1 classid 1:10 cbq bandwidth 512Kbit rate 
64Kbit weight 6Kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded 
isolated
tc qdisc add dev ppp0 parent 1:10 tbf rate 64Kbit buffer 10Kb/8 limit 15Kb 
mtu 1500
tc filter add dev ppp0 parent 1:0 protocol ip prio 100 u32 match ip src 
<the SRC IP of my VPN> flowid 1:10

Okay, so, with this, packets comming trought ppp0 and from <the SRC IP of 
my VPN> should be shaped at 64Kbit/s, right ?

Where''s my error ? Is there something more simple (eg. with iptables
and
packet marking ?)


thx for help :)
____________________________________
  ''Spyou'' - www.spyou.org - root@spyou.org
     #gtr / ircnet.grolier.net - UIN : 6871374

We''ve done so much, for so long, with so little
We''re now qualified to do anything with nothing.

On Tue, Feb 20, 2001 at 11:47:25AM +0100, Spyou wrote:
> tc filter add dev ppp0 parent 1:0 protocol ip prio 100 u32 match ip src 
> <the SRC IP of my VPN> flowid 1:10
> 
> Okay, so, with this, packets comming trought ppp0 and from <the SRC IP
of
> my VPN> should be shaped at 64Kbit/s, right ?
This line shapes outgoing traffic with a source address of your VPN!
> Where''s my error ? Is there something more simple (eg. with
iptables and
> packet marking ?)
Look into the ingress scheduler.

Regards,

bert

-- 
http://www.PowerDNS.com      Versatile DNS Services  
Trilab                       The Technology People   
''SYN! .. SYN|ACK! .. ACK!'' - the mating call of the internet

On Tue, 20 Feb 2001, Spyou wrote:
> i''m trying to shape incoming trafic on my linux box.
I think putting the following on your system is a must:
http://defiant.coinet.com/iproute2/equinox/cbq_init.html
 
> I want it to depend on the source IP adress of the packets (in fact, i got 
> a VPN on an ADSL link and wanted to get at least/max 64Kbit/s for the VPN)
> 
> So i tried this :
[all those commands that would make iproute newbies like hitting a thick
wall at 100mph; and after two weeks, the wall is as thick as before;
deleted] 
> Okay, so, with this, packets comming trought ppp0 and from <the SRC IP
of
> my VPN> should be shaped at 64Kbit/s, right ?
It is explained that iproute limits outgoing bandwidth only
("outgoing"
if seen _from_ your net devices). Recently, I tried something that seems
to be working; my setup:

          128Kbit      100Mbit  
[Internet]-------[eth1]-------[eth0]
                              192.168.1.x
                              Squid

I wanted to limit web access to about 40Kbit. The entry file for cbq.init:
DEVICE=eth0,100Mbit,10Mbit
RATE=40Kbit
WEIGHT=4Kbit
PRIO=7
RULE=:80,192.168.1.x
BOUNDED=no
ISOLATED=yes

Meaning: the device used is eth0, at 100Mbit. Transfer rate is at 40Kbit. 
The traffic from port 80, from any addresses that go to 192.168.1.x, will
use 40Kbit, at least. It is unbounded, so if the line still permits
(128Kbit), the traffic from port 80 would borrow the remaining bandwidth.
But the limiter has priority of 7, which will release the borrowed
bandwidth to any higher (1-6) priority limiters.

I thought that this setting wouldn''t work. But it seems that iproute
limits the traffic "from eth0 to 192.168.1.x"; which, in a sense, is
"outgoing".

I monitor the traffic using MRTG, the graphs are fine. And also, cbg.init
has "stats" command so you can see which unbounded limiters that
borrow
bandwidth from the others.  
> Where''s my error ? 
For not using cbq.init...?
>Is there something more simple (eg. with iptables and 
> packet marking ?)
You can use iptables along with cbq.init (no, cbq.init doesn''t support
packet marking yet); all you need is to name the entry-files correctly
(the names become the classid of the limiters), and then execute iptables
for packet filtering after cbq.init (use the flowid''s accordingly;
according to the entry-file names).

Oki
ps: the above cbq.init''s config would have problem if the machine
accessed
other internal machines at port 80; so the web traffic would be limited
also.  But for the problem that was at hand, is no problem. 
 
--
					So much free software
					So little time...