Shorewall users - Feb 2010 - IP mark with Transparent proxy don't work?

Hello !!!

First of all, sorry for my poor english.
I am talking from brasil, and english is not my first language.

I''ve been an enthusiastic user of Shorewall in the last 5 years.
Now, I am trying to do traffic shaping by IP Address.
I want to do it in both incoming and outgoing traffic.

I have a Shorewall Box between the internet and my local network with 
about 20 clients.

My premises:

a) Let the traffic going in both directions at the max speed that is 
possible.
b) Do not allow that one client suck all the band in detriment of the 
others.
c) Allow maximum use of the connection between the current users.
d) Prioritize the traffic in that order : ssh, www, smtp, ftp, others.
e) Not forbid any kind of traffic from the local zone to the internet.
f) Can determine who is on.

My Services:
  In my Shorewall Box I am using:
  Bind, Dhcp (with static addresses by mac address) and Squid (with 
Transparent proxy)



I decided to shaping incoming traffic, basically because I''m afraid
that
some people are using download accelerators and p2p all the time and 
compromising my second law.

Everything is working well (accounting working fine), with one dysfunction:

I can not make the Ip mark work on the www traffic (while accounting can 
do).
(could be because of the redirect rule for transparent proxy in the 
rules file?)


I want to take this opportunity to express my gratitude for your great job.

Can You help me to bypass this problem ?
if possible, can You show me how to improve my effort?


Cesar Alano




------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev

cesar@syshouse.com.br wrote:
th one dysfunction:
> 
> I can not make the Ip mark work on the www traffic (while accounting can 
> do).
> (could be because of the redirect rule for transparent proxy in the 
> rules file?)
Yes. There are two ways to approach this:

a) Assuming that your incoming traffic is being shaped on your internal
interface (int-if), you can mark the www traffic in the OUTPUT chain:

	<mark>	$FW	<int-if>      tcp      -       80

b) You can implement delay pools in your Squid configuration.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________



------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev