Indunil Jayasooriya
2007-Aug-02 09:18 UTC
[CentOS] Allocating 64 kbits/s out of 256 kbits/s for one LAN behing firewall
Hi, We have a 256 kbits/s (kilobits per second) link to the internet. it is a router running Linux that belongs to our ISP. They have given us 8 internet ips. (i.e- subnet is 255.255.255.248). one has been given to this router. I have given another internet ip to the firewall running CentOS 4.5. iptables is running on it. And also, I have installed iproute2 pkg as well. pls see below for installed pkgs. [root at firebox ~]# rpm -qa |grep iptables iptables-1.2.11-3.1.RHEL4 [root at firebox ~]# rpm -qa |grep iproute iproute-2.6.9-3.EL4.3.centos4 This firewall has 3 ethernet cards at the moment. one is connected to router. one is connected to our DMZ zone. one is connected to LAN1. These are ips of the firewall. eth0 (internet) - 1.2.3.4/255.255.255.248 (pls assume it. For security reason, I will not give you the actual ip) eth1 (DMZ Zone) - 192.168.100.254/255.255.255.0 eth2 (LAN1) - 192.168.101.254/255.255.255.0 Now, everyone in LAN1 has access to internet. (due to SNAT rule) Now, I want to install another ethernet card to this firewall. then, it would be eth3. eth3 will be as follows. eth3 (LAN2) - 192.168.102.254/255.255.255.0 Now, I want put about 5 people (5 PCs) behind this LAN2 and give internet access to them. But, I do not want them to use my whole bandwidth (i.e - 256 kbit/s), But Instead, I want peple behind this LAN2 to allocate 64 kbits/s(kilo bits per second) for their internert access. Is it possible to acheive this task on firewall running iptables and iproute2 (CentOS 4.5) ? If so, How can I do such thing? If I do such thing, what will happen to the people behind LAN1 ? Will they get whole 256 kbits/s as before or will they get 256 kbit/s - 64 kbit/s for their internet access? Hope to hear form you. -- Thank you Indunil Jayasooriya -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20070802/dbaefc26/attachment-0001.html>
Indunil Jayasooriya
2007-Aug-02 09:18 UTC
Allocating 64 kbits/s out of 256 kbits/s for one LAN behing firewall
Hi, We have a 256 kbits/s (kilobits per second) link to the internet. it is a router running Linux that belongs to our ISP. They have given us 8 internet ips. (i.e- subnet is 255.255.255.248 ). one has been given to this router. I have given another internet ip to the firewall running CentOS 4.5. iptables is running on it. And also, I have installed iproute2 pkg as well. pls see below for installed pkgs. [root@firebox ~]# rpm -qa |grep iptables iptables-1.2.11-3.1.RHEL4 [root@firebox ~]# rpm -qa |grep iproute iproute-2.6.9-3.EL4.3.centos4 This firewall has 3 ethernet cards at the moment. one is connected to router. one is connected to our DMZ zone. one is connected to LAN1. These are ips of the firewall. eth0 (internet) - 1.2.3.4/255.255.255.248 (pls assume it. For security reason, I will not give you the actual ip) eth1 (DMZ Zone) - 192.168.100.254/255.255.255.0 eth2 (LAN1) - 192.168.101.254/255.255.255.0 Now, everyone in LAN1 has access to internet. (due to SNAT rule) Now, I want to install another ethernet card to this firewall. then, it would be eth3. eth3 will be as follows. eth3 (LAN2) - 192.168.102.254/255.255.255.0 Now, I want put about 5 people (5 PCs) behind this LAN2 and give internet access to them. But, I do not want them to use my whole bandwidth ( i.e - 256 kbit/s), But Instead, I want peple behind this LAN2 to allocate 64 kbits/s (kilo bits per second) for their internert access. Is it possible to acheive this task on firewall running iptables and iproute2 (CentOS 4.5) ? If so, How can I do such thing? If I do such thing, what will happen to the people behind LAN1 ? Will they get whole 256 kbits/s as before or will they get 256 kbit/s - 64 kbit/s for their internet access? Hope to hear form you. -- Thank you Indunil Jayasooriya -- Thank you Indunil Jayasooriya _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Feizhou
2007-Aug-02 09:42 UTC
[CentOS] Allocating 64 kbits/s out of 256 kbits/s for one LAN behing firewall
> Is it possible to acheive this task on firewall running iptables and > iproute2 (CentOS 4.5) ? > > If so, How can I do such thing? > > If I do such thing, what will happen to the people behind LAN1 ? Will > they get whole 256 kbits/s as before or will they get 256 kbit/s - 64 > kbit/s for their internet access?Yes. use firewall marks and tc. http://lartc.org/
John R Pierce
2007-Aug-02 15:45 UTC
[CentOS] Allocating 64 kbits/s out of 256 kbits/s for one LAN behing firewall
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Indunil Jayasooriya wrote:<br> <blockquote cite="mid7ed6b0aa0708020218s31b0448cxb8ec8d7147173cac@mail.gmail.com" type="cite">Now, I want put about 5 people (5 PCs) behind this LAN2 and give internet access to them. But, I do not want them to use my whole bandwidth ( i.e - 256 kbit/s), But Instead, I want peple behind this LAN2 to allocate <span style="font-weight: bold;">64 kbits/s</span> (kilo bits per second) for <span style="font-weight: bold;">their internert access</span>. <br> <br> </blockquote> <br> what if noone on LAN1 is using the net at the moment? do you still want to restrict LAN2 to 64k? why waste the bandwidth?<br> <br> <br> <blockquote cite="mid7ed6b0aa0708020218s31b0448cxb8ec8d7147173cac@mail.gmail.com" type="cite">Is it possible to acheive this task on firewall running iptables and iproute2 (CentOS 4.5) ? <br> <br> If so, How can I do such thing? <br> <br> </blockquote> <br> the clues are in the LARTC howto (Linux Advanced Routing and Traffic Control) What you want to do is generally known as 'traffic shaping'.<br> <br> <blockquote cite="mid7ed6b0aa0708020218s31b0448cxb8ec8d7147173cac@mail.gmail.com" type="cite">If I do such thing, what will happen to the people behind LAN1 ? Will they get whole 256 kbits/s as before or will they get 256 kbit/s - 64 kbit/s for their internet access? <br> <br> </blockquote> <br> <br> you can't get 5 lbs of stuff in a 4 lb. sack. :)<br> <br> if you've allowed max 64k for one class of users, and they are actively using it, and your traffic shaping guarantees them that 64k, then there's only 192k left for anyone else.<br> </body> </html>
Indunil Jayasooriya
2007-Aug-06 07:05 UTC
Re: Allocating 64 kbits/s out of 256 kbits/s for one LAN behingfirewall
Hi, Thanks for your script. I am still a newbie to this traffic control. I have only done polcy routing with iproute2. I was thinking how to write this script. You have already given a start. I have been reading Below URLs. http://lartc.org/howto/lartc.qdisc.classful.html http://edseek.com/~jasonb/articles/traffic_shaping/linuxtc.html http://tldp.org/HOWTO/Traffic-Control-HOWTO/index.html http://edseek.com/~jasonb/articles/traffic_shaping/classes.html#qdiscex But, I still find it dificult to understand fully. Hey, shall We disculls the script you wrote below . I understand below 4 rules. last rule marks 192.168.102.0/24 traffic as 5> > INTERFAZ_INT=eth0 > > BAND=256 > > BAND_CLIENTS=64 > > iptables -t mangle -A PREROUTING -s 192.168.102.0/24 -j MARK --set-mark > 0x5 >But, I do not understand below rules. shall we discuss one by one.> tc qdisc add dev $INTERFAZ_INT root handle 1 htb r2q 4 >the above rule adds a qdisc to internet interace. what is r2q ad 4 there ?. I do not understand those two.> tc class add dev $INTERFAZ_INT parent 1: classid 1:2 htb rate "$BAND"Kbit >FULL bandwidth with above rule. tc class add dev $INTERFAZ_INT parent 1: classid 1:5 htb rate> "$BAND_CLIENTS"Kbit >and 64 kbit with above with above rule. tc qdisc add dev $INTERFAZ_INT parent 1:5 handle 5 sfq perturb 10>What is this above rule?, I don not understand at all. tc filter add dev $INTERFAZ_INT protocol ip parent 1: pref 1 handle 10 fw> classid 1:5 >I do not understand the above rule too. hope to hear from you. Feel free to ask to me what you wish.>THAKS for above comment. Regards> > Paolo Malfatti > > > ------------------------------ > From: *"Indunil Jayasooriya" <indunil75@gmail.com>* > To: *lartc@mailman.ds9a.nl* > Subject: *[LARTC] Allocating 64 kbits/s out of 256 kbits/s for one LAN > behingfirewall* > Date: *Thu, 2 Aug 2007 14:48:55 +0530* > > > Hi, > > We have a 256 kbits/s (kilobits per second) link to the internet. it is a > router running Linux that belongs to our ISP. They have given us 8 internet > ips. (i.e- subnet is > 255.255.255.248 > ). one has been given to this router. I have given another internet ip to > the firewall running CentOS 4.5. iptables is running on it. And also, I > have installed iproute2 pkg as well. > > pls see below for installed pkgs. > > [root@firebox ~]# rpm -qa |grep iptables > iptables-1.2.11-3.1.RHEL4 > [root@firebox ~]# rpm -qa |grep iproute > iproute-2.6.9-3.EL4.3.centos4 > > > This firewall has 3 ethernet cards at the moment. one is connected to > router. one is connected to our DMZ zone. one is connected to LAN1. > > These are ips of the firewall. > > eth0 (internet) - > 1.2.3.4/255.255.255.248 (pls assume it. For security reason, I will not > give you the actual ip) > eth1 (DMZ Zone) - > 192.168.100.254/255.255.255.0 > eth2 (LAN1) - > 192.168.101.254/255.255.255.0 > > Now, everyone in LAN1 has access to internet. (due to SNAT rule) > > Now, I want to install another ethernet card to this firewall. then, it > would be eth3. > > eth3 will be as follows. > > > eth3 (LAN2) - 192.168.102.254/255.255.255.0 > > Now, I want put about 5 people (5 PCs) behind this LAN2 and give internet > access to them. But, I do not want them to use my whole bandwidth ( > i.e - 256 kbit/s), But Instead, I want peple behind this LAN2 to allocate > 64 kbits/s (kilo bits per second) for their internert access. > > Is it possible to acheive this task on firewall running iptables and > iproute2 (CentOS 4.5) ? > > If so, How can I do such thing? > > If I do such thing, what will happen to the people behind LAN1 ? Will they > get whole 256 kbits/s as before or will they get 256 kbit/s - 64 kbit/s for > their internet access? > > > > Hope to hear form you. > > > > > > > > > > > -- > Thank you > Indunil Jayasooriya > > > -- > Thank you > Indunil Jayasooriya > > >_______________________________________________ > >LARTC mailing list > >LARTC@mailman.ds9a.nl > >http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > > ------------------------------ > Las mejores tiendas, los precios mas bajos, entregas en todo el mundo, > YupiMSN Compras: Haz clic aquí... <http://g.msn.com/8HMBES/2746??PS=47575>-- Thank you Indunil Jayasooriya _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Indunil Jayasooriya
2007-Aug-08 07:00 UTC
Re: Allocating 64 kbits/s out of 256 kbits/s for one LAN behingfirewall
Hi Paolo Malfatti,
Thanks for your script. I tried it .
But I still can not allocate 64 kbit for LAN. We have a 256 kbit link. We
usually download around @ 30-33 kbytes per second. That means, when it
comes to kbits, I will have to mulitple it in to 8 as 1kbps=8kbit .
pls see below for usual download rate, before applying your rules.
[root@worldnet wget]# wget
http://mirrors.kernel.org/centos/5.0/isos/i386/CentOS-5.0-i386-bin-6of6.iso
--12:16:27--
http://mirrors.kernel.org/centos/5.0/isos/i386/CentOS-5.0-i386-bin-6of6.iso
=> `CentOS-5.0-i386-bin-6of6.iso.1''
Resolving mirrors.kernel.org... 204.152.191.7, 204.152.191.39
Connecting to mirrors.kernel.org|204.152.191.7|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 407,005,184 (388M) [application/x-iso9660-image]
0%
[
] 2,749,752 30.10K/s ETA 4:43:0
Then, I applied your rules. pls see below
INTERFAZ_INT=eth0
FULLBANDWIDTH=256
BANDWIDTH4LAN=64
iptables -t mangle -A PREROUTING -s
192.168.101.0/24<http://192.168.102.0/24>-j MARK --set-mark 0x5
tc qdisc add dev $INTERFAZ_INT root handle 1 htb r2q 4
tc class add dev $INTERFAZ_INT parent 1: classid 1:2 htb rate
"$FULLBANDWIDTH"Kbit
tc class add dev $INTERFAZ_INT parent 1: classid 1:5 htb rate
"$BANDWIDTH4LAN"Kbit
tc qdisc add dev $INTERFAZ_INT parent 1:5 handle 5 sfq perturb 10
tc filter add dev $INTERFAZ_INT protocol ip parent 1: pref 1 handle 5 fw
classid 1:5
Still no luck. after applying rules, I downloaded an centos ISO image. But ,
I still can download @ usual rate. (i.e 30-33 kbytes per seconds).
If your rules work, I will be able to download @ about 8 kbyes per second. (
i.e - 8*8 kbit= 64 kbit)
That is what I expect ?
Where have I gone wrong?
On 8/7/07, Pio Mendez <pio_mendez@hotmail.com>
wrote:>
> >What is r2q ad 4 there ?. I do not understand those two.
> I recommend you to read this:
>
> >
http://luxik.cdi.cz/~devik/qos/htb/<http://luxik.cdi.cz/%7Edevik/qos/htb/>
> >
> the r2q is a divisor used to calculate the quantum of htb (the amount of
> bytes that will be transmitted before serving another class: quantum = rate
> / r2q).
>
> >tc qdisc add dev $INTERFAZ_INT parent 1:5 handle 5 sfq perturb 10
> >What is this above rule?, I don not understand at all.
> a must: http://lartc.org/howto/lartc.qdisc.html
>
> The classes do shape of traffic, but you need a Queue manager to trasmit
> it (qdisc rule). Here you will find an example of HTB script:
> http://lartc.org/howto/lartc.qdisc.classful.html#AEN1072
>
> >tc filter add dev $INTERFAZ_INT protocol ip parent 1: pref 1 handle 10
fw
> classid 1:5
> >I do not understand the above rule too.
>
> there is an error: the right filter rule is:
> tc filter add dev $INTERFAZ_INT protocol ip parent 1: pref 1 handle 5 fw
> classid 1:5
>
> The filter rule filter the traffic and send the mathing packets to the
> right class.
> The iptables MARK rule mark the traffic before the SNAT. Later, after all
> iptables processing, the packets are filtered by this rule; if some packet
> match the "handle 5" filter (packet marked with 5 by the
iptables rule will
>
> match) then it will be shaped by htb class to 64kbps.
>
> Hope this will help
> Regards
> Paolo Malfatti
>
>
> ------------------------------
> MSN Amor Busca tu ½ naranja <http://g.msn.com/8HMAES/2740??PS=47575>
--
Thank you
Indunil Jayasooriya
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc