[LARTC] ingress policing based on source address?

[LARTC] ingress policing based on source address?

[Simon Oosthoek]

Hi all

I'm new to this list, but not exactly to iproute stuff.

I'd like to solve a specific problem with bandwidth coming from 
different external sources towards the internal network (also the other 
way around, but I figure that's not so much a problem, since that is 
egress traffic shaping).

The network looks like this:

internet ------ ISP-------[shaping/router]
  |                |                +-   net1 -------- host1
mirrors          host2              +-   net2
                                 
in text: we connect to the internet via an ISP, where we also have an 
externally accessible host (host2). Internally we use NAT and several 
subnets.

We have a 100Mbit/s connection to the ISP, but we only pay for 1Mbit/s. 
So in order to keep our traffic within the agreed parameters, we need to 
police our incoming and outgoing traffic. However the traffic from and 
to the ISP and host2 doesn't have to be policed.

For our external traffic there's not much problem to shape the traffic 
in the egress queues (using HTB and TBF/SFQ stuff). This is well 
described in the LARTC howto documentation.

My problem is with the incoming traffic. The examples in the howto don't 
go very much into this and from what I understand the ingress queue is 
much less advanced than the egress queue. I read something about an 
intermediate queue, but I don't understand how that works (yet).

My question is whether this is something I can do using the ingress 
queue, somehow defining filter rules with different queue associated 
with that, or whether someone has experience with a similar configuration.

If this is not possible, I might be able to solve it differently by 
adding another host with just 2 interfaces and using only egress queues, 
but I'd prefer limiting my solution to a single host.

Thanks in advance

Simon
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] ingress policing based on source address?

[Simon Oosthoek]

Hi all

I'm new to this list, but not exactly to iproute stuff.

I'd like to solve a specific problem with bandwidth coming from
different external sources towards the internal network (also the other
way around, but I figure that's not so much a problem, since that is
egress traffic shaping).

The network looks like this:

internet ------ ISP-------[shaping/router]
  |                |                +-   net1 -------- host1
mirrors          host2              +-   net2

in text: we connect to the internet via an ISP, where we also have an
externally accessible host (host2). Internally we use NAT and several
subnets.

We have a 100Mbit/s connection to the ISP, but we only pay for 1Mbit/s.
So in order to keep our traffic within the agreed parameters, we need to
police our incoming and outgoing traffic. However the traffic from and
to the ISP and host2 doesn't have to be policed.

For our external traffic there's not much problem to shape the traffic
in the egress queues (using HTB and TBF/SFQ stuff). This is well
described in the LARTC howto documentation.

My problem is with the incoming traffic. The examples in the howto don't
go very much into this and from what I understand the ingress queue is
much less advanced than the egress queue. I read something about an
intermediate queue, but I don't understand how that works (yet).

My question is whether this is something I can do using the ingress
queue, somehow defining filter rules with different queue associated
with that, or whether someone has experience with a similar configuration.

If this is not possible, I might be able to solve it differently by
adding another host with just 2 interfaces and using only egress queues,
but I'd prefer limiting my solution to a single host.

Thanks in advance

Simon

PS, if this is the second time you get this message, I was too impatient 
and sent the first one before my confirmation was in....
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ingress policing based on source address?

[Andy Furniss]

Simon Oosthoek wrote:
> Hi all
> 
> I'm new to this list, but not exactly to iproute stuff.
> 
> I'd like to solve a specific problem with bandwidth coming from
> different external sources towards the internal network (also the other
> way around, but I figure that's not so much a problem, since that is
> egress traffic shaping).
> 
> The network looks like this:
> 
> internet ------ ISP-------[shaping/router]
>  |                |                +-   net1 -------- host1
> mirrors          host2              +-   net2
> 
> in text: we connect to the internet via an ISP, where we also have an
> externally accessible host (host2). Internally we use NAT and several
> subnets.
> 
> We have a 100Mbit/s connection to the ISP, but we only pay for 1Mbit/s.
> So in order to keep our traffic within the agreed parameters, we need to
> police our incoming and outgoing traffic. However the traffic from and
> to the ISP and host2 doesn't have to be policed.
> 
> For our external traffic there's not much problem to shape the traffic
> in the egress queues (using HTB and TBF/SFQ stuff). This is well
> described in the LARTC howto documentation.
> 
> My problem is with the incoming traffic. The examples in the howto don't
> go very much into this and from what I understand the ingress queue is
> much less advanced than the egress queue. I read something about an
> intermediate queue, but I don't understand how that works (yet).
> 
> My question is whether this is something I can do using the ingress
> queue, somehow defining filter rules with different queue associated
> with that, or whether someone has experience with a similar configuration.
> 
> If this is not possible, I might be able to solve it differently by
> adding another host with just 2 interfaces and using only egress queues,
> but I'd prefer limiting my solution to a single host.

You could use IMQ www.linuximq.net to save you using another box, but 
the way you get your bandwidth (ie. no real bottleneck) may make it 
suitable for just the "dumb" ingress policer. Maybe you have good 
reasons to want to classify/shape ingress in a complicated way.

Andy.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/