[LARTC] Please advise how to set up for 5 IPs

[LARTC] Please advise how to set up for 5 IPs

[gypsy]

I have need to use HTB on multiple (5) IPs.

The present setup has the DSL connection going to a switch and then each
computer with an external IP configures the external interface to listen
on that IP.

I have had TERRIBLE luck trying to use iptables to DNAT so if DNAT needs
to be done, any advice that includes tested and working examples would
be sincerely appreciated.

There are 3 computers connected to the switch:
1) yesican.chsoft.biz 206.72.89.154
  This also listens on eth1:0 to 206.72.89.158 as ns.chsoft.biz
2) news.chsoft.biz    206.72.89.155
3) phil.chsoft.biz    206.72.89.156

yesican (AKA ns) and news are both Slackware Linux boxes and each has a
working HTB script.  news' (non-business hours) script is at
ftp://andthatsjazz.org/pub/lartc/ultimatePM.sh.

phil is a Windows 2000 Server and between it and the switch is a
SonicWall (hardware) firewall.

How should I set up so that one computer can listen to all 5 IPs, shape
and then distribute the shaped packets to the correct server?

How can I implement ingress shaping / policing to limit the combined
incoming rate, regardless of IP, to about 700K (the connection is
actually 730K in and 690K out).  Only because it REALLY annoys me to
drop an already received packet, I would prefer to shape than to drop,
but I am presently policing.

I would like to avoid, for space and room temperature reasons, another
computer if possible.

May I please hear your $.02?  Thanks!

gypsy
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Please advise how to set up for 5 IPs

[Jason Boxman]

On Tuesday 28 September 2004 15:36, gypsy wrote:
<snip>
> How can I implement ingress shaping / policing to limit the combined
> incoming rate, regardless of IP, to about 700K (the connection is
> actually 730K in and 690K out).  Only because it REALLY annoys me to
> drop an already received packet, I would prefer to shape than to drop,
> but I am presently policing.

I can't see how you could shape other than to drop.  You have already received 
the packet.  If it's over the rate for that particular flow, and the traffic 
is TCP, you can only hope enough drops will result in the connection being 
throttled by the remote end's TCP stack.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Please advise how to set up for 5 IPs

[Andy Furniss]

Jason Boxman wrote:
> On Tuesday 28 September 2004 15:36, gypsy wrote:
> <snip>
> 
>>How can I implement ingress shaping / policing to limit the combined
>>incoming rate, regardless of IP, to about 700K (the connection is
>>actually 730K in and 690K out).  Only because it REALLY annoys me to
>>drop an already received packet, I would prefer to shape than to drop,
>>but I am presently policing.
> 
> 
> I can't see how you could shape other than to drop.  You have already received 
> the packet.  If it's over the rate for that particular flow, and the traffic 
> is TCP, you can only hope enough drops will result in the connection being 
> throttled by the remote end's TCP stack.

Queueing is important aswell as dropping. You will need to drop 
sometimes, but you can decide to only queue/drop bulk traffic if you 
shape with htb. For ingress, or more correctly, shaping from the wrong 
and of a bottleneck I like to use esfq (so I can choose length) with 
classic hash - so that each tcp gets dequeued at the rate it's entitled 
- rather than a burst at near full speed followed by a wait while others 
are serviced. Shaping from the narrow end of the bottleneck is hard if 
you care alot about latency and don't want to sacrifice too much 
bandwidth. SFQ helps prevent burstiness over other queues - but don't 
set perturb too low - Default (10) is OK, I use 20. It causes packet 
reordering which hurts latency when shaping incoming - the effect is 
worse with single connections.

There are other tweaks possible but they are probably not worth the 
hassle unless you are noticing problems.

Andy.


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/