LARTC - Feb 2006 - marking and limiting P2P packets

Hello, I am trying to shape p2p trafik to 256kbps on my dsl line. I wrote
this set of commands:

 

DEV=eth2

ip link set imq0 up

tc qdisc add dev imq0 root handle 1:0 htb default 21 r2q 2

tc class add dev imq0 parent 1:0 classid 1:1 htb rate 530kbit

tc class add dev imq0 parent 1:1 classid 1:20 htb rate 530kbit ceil 530kbit
prio 0

tc class add dev imq0 parent 1:1 classid 1:21 htb rate 64kbit ceil 256kbit
prio 1

tc qdisc add dev imq0 parent 1:20 handle 20:0 sfq perturb 10

tc qdisc add dev imq0 parent 1:21 handle 21:0 sfq perturb 10

tc filter add dev imq0 parent 1:0 prio 0 protocol ip handle 6 fw flowid 1:20

tc filter add dev imq0 parent 1:0 prio 1 protocol ip handle 7 fw flowid 1:21

iptables -t mangle -N DSL-IN

iptables -t mangle -I PREROUTING -i $DEV -j DSL-IN

iptables -t mangle -A DSL-IN -p tcp -j CONNMARK --restore-mark

iptables -t mangle -A DSL-IN -p tcp -m mark ! --mark 0 -j ACCEPT

iptables -t mangle -A DSL-IN -p tcp -m ipp2p --ipp2p -j MARK --set-mark 7

iptables -t mangle -A DSL-IN -p tcp -m mark --mark 7 -j CONNMARK --save-mark

iptables -t mangle -A DSL-IN -p udp -m ipp2p --ipp2p -j MARK --set-mark 7

iptables -t mangle -A DSL-IN -m mark --mark 0 -j MARK --set-mark 6

iptables -t mangle -A DSL-IN -j IMQ --todev 0

 

marked p2p packets goes to 1:21

ant not marked packets goes to 1:20

 

And its not working :( I tried this script with ports 21, 80 insteed of p2p
mark… then it is working, I’m thinking that the problem is on marking p2p
packets…what is wrong?

 

Linux Debian 2.4.32.v1 #1 SMP Mon Jan 30 00:14:04 UTC 2006 i686 GNU/Linux

iptables v1.3.4

ip utility, iproute2-ss041019

IPP2P v0.8.1_rc1

 

______________________________________ 

Vaidas  

VDXnet sistemų administratorius  



_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

On Thu, 2 Feb 2006 14:12:45 +0200
"Vaidas" <admin@vdx.lt> wrote:

> iptables -t mangle -A DSL-IN -p tcp -j CONNMARK --restore-mark
> 
> iptables -t mangle -A DSL-IN -p tcp -m mark ! --mark 0 -j ACCEPT
> 
> iptables -t mangle -A DSL-IN -p tcp -m ipp2p --ipp2p -j MARK --set-mark 7
> 
> iptables -t mangle -A DSL-IN -p tcp -m mark --mark 7 -j CONNMARK
--save-mark
> 
> iptables -t mangle -A DSL-IN -p udp -m ipp2p --ipp2p -j MARK --set-mark 7
> 
> iptables -t mangle -A DSL-IN -m mark --mark 0 -j MARK --set-mark 6
> 
> iptables -t mangle -A DSL-IN -j IMQ --todev 0
What about saving the marks with ''-j CONNMARK --save-mark''
unconditionally as
the last rule of DSL-IN chain?

Ethy