[LARTC] One tc filter police for 2 subnets

[LARTC] One tc filter police for 2 subnets

[Luciano Lima]

I´d like to limit input traffic from 2 subnets. Ex. 128Kbps for the two
subnets: 10.0.0.0/24 10.0.1.0/24

Like:
tc filter add dev eth3 parent ffff: protocol ip prio 5 u32 match ip src
10.0.0.0/24 ; 10.0.1.0/24 police rate 128kbit burst 10k drop flowid :1

Obviously this command did not work because tc does not accept two subnets
as src separeted by ";".

Is there a way of doing this ?

Thanks a lot,

Luciano Lima

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] One tc filter police for 2 subnets

[Rene Gallati]

Hello,

> Like:
> tc filter add dev eth3 parent ffff: protocol ip prio 5 u32 match ip src
> 10.0.0.0/24 ; 10.0.1.0/24 police rate 128kbit burst 10k drop flowid :1
> 
> Obviously this command did not work because tc does not accept two subnets
> as src separeted by ";".
> 
> Is there a way of doing this ?

Sure, 10.0.0.0/24 and 10.0.1.0/24 can be aggregated as 10.0.0.0/23. This 
might have been only an example of yours but if you have adjacent 
netblocks, you can often aggregate them iff they match into a given netmask.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/