Re: [LARTC] outbound shaping

[gypsy <gypsy@iswest.com>]

nix4me wrote:
> 24.xxx.xxx.xxx
>        |router|
> 192.168.1.1
>        |switch|
> 192.168.1.100 & 192.168.1.101

So can we assume that 192.168.1.1 has 2 NICs, eth0 facing 24.x.x.x/32
and eth1 facing 192.168.1.0/24?
 
> I am running proftpd on (192.168.1.101) with the port set to 65437 and
> with passive ports set to 50000-51000.  Proftpd allows you to specify a
> range of ports to use on passive transfers.  I need to be able to limit
> my outbound ftp traffic to 40 Kbytes per second.
> The only way I can see to do this is limit by marking packets with
> iptables.  I am marking traffic on 65436 which is the active ftp data
> port (65437-1) and 50000-60000.  Outbound shaping is working
> fine....however....inbound ftp traffic is also being shaped to 40K.  I
> have no idea why.
> 
> Seems to me the below rules should mark outbound packets and shape only
> outbound packets.  I dont understand why inbound packets are getting shaped.
> 
> Here is the script:
> #!/bin/bash
> #shaping passive and active outbound ftp traffic on an internal computer
> without affecting inbound and lan speed
> 
> # mark the outbound passive ftp packets on ports 50000-51000
> iptables -t mangle -N MYSHAPER-OUT
> iptables -t mangle -I OUTPUT -o eth0 -j MYSHAPER-OUT
> 
> iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 65436 -j MARK
> --set-mark 20
> iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 50000:51000 -j MARK
> --set-mark 20
> iptables -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 26

1) Are you sure these rules are correctly marking and that the marks
exist at the time the tc filter sees the packet?  My hunch is NOT. 
ASIDE: We _really_ need a way for filters to report hit counts!

2) Since 1:26 is htb default, why is it necessary to '--set-mark 26'?

gypsy
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/