Hi, I am using the following script to limit my outbound traffic. This scipt runs on a box behind my firewall. It limits my outbound passive ftp traffic to 39K perfectly....just like i want. However, i just noticed that it is also limiting uploads coming to my server. Is there something I can change to make it not limit uploads to my server? #!/bin/bash #shaping passive ftp traffic # mark the outbound passive ftp packets on ports 50000-51000 iptables -t mangle -D POSTROUTING -o eth0 -j MYSHAPER-OUT 2> /dev/null > /dev/null iptables -t mangle -F MYSHAPER-OUT 2> /dev/null > /dev/null iptables -t mangle -X MYSHAPER-OUT 2> /dev/null > /dev/null iptables -t mangle -N MYSHAPER-OUT iptables -t mangle -I POSTROUTING -o eth0 -j MYSHAPER-OUT iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 65437 -j MARK --set-mark 20 iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 50000:51000 -j MARK --set-mark 20 #iptables -t mangle -A MYSHAPER-OUT -p tcp --dport 50000:65437 -j MARK --set-mark 20 iptables -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 26 # clear it tc qdisc del dev eth0 root #add the root qdisk tc qdisc add dev eth0 root handle 1: htb default 26 #add main rate limit class tc class add dev eth0 parent 1: classid 1:1 htb rate 10000mbps #add leaf classes tc class add dev eth0 parent 1:1 classid 1:26 htb rate 10000mbps tc class add dev eth0 parent 1:1 classid 1:20 htb rate 39kbps #filter traffic into classes tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20 tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 26 fw flowid 1:26 Mark _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
On Thu, 2004-10-07 at 05:51, nix4me@cfl.rr.com wrote:> Is there something I can change to make it not limit uploads to my server?Theory is.. You can only shape outbound traffic. Inbound is via tcp windowshaping etc..> # mark the outbound passive ftp packets on ports 50000-51000> iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 65437 -j MARK --set-mark 20 > iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 50000:51000 -j MARK --set-mark 20 > #iptables -t mangle -A MYSHAPER-OUT -p tcp --dport 50000:65437 -j MARK --set-mark 20 > iptables -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 26The way I read this is.. anything that has a source port of 50000-51000 and a destination port of 50000 - 65437 will be marked as handle 20 Why do you care about destination port? AFAIK, it shouldn''t affect your wants since you''re not filtering on incoming traffic> #add leaf classes > tc class add dev eth0 parent 1:1 classid 1:26 htb rate 10000mbpsIs this legal?? 10000mbps?? Wow.. 10000*1E6?> tc class add dev eth0 parent 1:1 classid 1:20 htb rate 39kbps > > #filter traffic into classes > tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20 > tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 26 fw flowid 1:26-- Ow Mun Heng Fedora GNU/Linux Core 2 on D600 1.4Ghz CPU kernel 2.6.7-2.jul1-interactive Neuromancer 10:50:12 up 1:29, 5 users, load average: 0.23, 0.42, 0.51 _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/