Re: [LARTC] ingress policing based on source address?

From: Andy Furniss <andy.furniss@dsl.pipex.com>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] ingress policing based on source address?
Date: Fri, 23 Apr 2004 23:33:37 +0000	[thread overview]
Message-ID: <4089A7D1.6090103@dsl.pipex.com> (raw)
In-Reply-To: <4087B4C8.6010008@ti-wmc.nl>

Simon Oosthoek wrote:
> Hi all
> 
> I'm new to this list, but not exactly to iproute stuff.
> 
> I'd like to solve a specific problem with bandwidth coming from
> different external sources towards the internal network (also the other
> way around, but I figure that's not so much a problem, since that is
> egress traffic shaping).
> 
> The network looks like this:
> 
> internet ------ ISP-------[shaping/router]
>  |                |                +-   net1 -------- host1
> mirrors          host2              +-   net2
> 
> in text: we connect to the internet via an ISP, where we also have an
> externally accessible host (host2). Internally we use NAT and several
> subnets.
> 
> We have a 100Mbit/s connection to the ISP, but we only pay for 1Mbit/s.
> So in order to keep our traffic within the agreed parameters, we need to
> police our incoming and outgoing traffic. However the traffic from and
> to the ISP and host2 doesn't have to be policed.
> 
> For our external traffic there's not much problem to shape the traffic
> in the egress queues (using HTB and TBF/SFQ stuff). This is well
> described in the LARTC howto documentation.
> 
> My problem is with the incoming traffic. The examples in the howto don't
> go very much into this and from what I understand the ingress queue is
> much less advanced than the egress queue. I read something about an
> intermediate queue, but I don't understand how that works (yet).
> 
> My question is whether this is something I can do using the ingress
> queue, somehow defining filter rules with different queue associated
> with that, or whether someone has experience with a similar configuration.
> 
> If this is not possible, I might be able to solve it differently by
> adding another host with just 2 interfaces and using only egress queues,
> but I'd prefer limiting my solution to a single host.

You could use IMQ www.linuximq.net to save you using another box, but 
the way you get your bandwidth (ie. no real bottleneck) may make it 
suitable for just the "dumb" ingress policer. Maybe you have good 
reasons to want to classify/shape ingress in a complicated way.

Andy.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/