From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rene Gallati Date: Thu, 05 Aug 2004 09:51:21 +0000 Subject: Re: [LARTC] should I shape tun[N] or eth0 ? Message-Id: <41120319.9070906@draxinusom.ch> List-Id: References: <200408041735.07132.etienne@unix.za.org> In-Reply-To: <200408041735.07132.etienne@unix.za.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable To: lartc@vger.kernel.org Hello, > If I have a few vpn tunnels with different tun interfaces. And all this t= unnel=20 > traffic is coming in on my eth0 interface, it also leave via eth0 again. = I=20 > would like to share the available bandwidth evenly with tunnel clients. W= ould=20 > applying the bandwidth rule on eth0 with htb & sfq work for sharing the=20 > bandwidth or will bandwidth rules only affect tunnel traffic if I apply i= t to=20 > the actual tun[n] intefaces ? I'm not sure if it works on tun devices, but on tap's it should work=20 since those actually look like normal ethernet devices. However if you=20 shape on the virtual interfaces you only shape the incoming traffic (ie=20 traffic going out a tun/tap is decrypted VPN traffic that is coming=20 *in*) So if you want to manage outgoing traffic, shape on eth0. Since=20 openVPN per default requires a single port for each VPN, you can easily=20 mark and classify the outgoing traffic with tc. For example: VPN1 udp 5000 <----> udp 5000 VPN2 udp 5001 <----> udp 5001 ... tc filter add dev eth0 parent 1:0 prio 10 u32 match udp sport 5000 dport=20 5000 flowid 1:2 tc filter add dev eth0 parent 1:0 prio 10 u32 match udp sport 5001 dport=20 5001 flowid 1:2 etc. to put all VPN traffic into class 1:2 Note that I didn't test this, so there might be an error in the lines=20 above but the outlined way should work. --=20 C U - -- ---- ----- -----/\/ Ren=E9 Gallati \/\---- ----- --- -- - _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/