Re: [LARTC] outbound shaping

[nix4me <nix4me@cfl.rr.com>]

gypsy wrote:

>nix4me wrote:
>  
>
>>24.xxx.xxx.xxx
>>       |router|
>>192.168.1.1
>>       |switch|
>>192.168.1.100 & 192.168.1.101
>>    
>>
>
>So can we assume that 192.168.1.1 has 2 NICs, eth0 facing 24.x.x.x/32
>and eth1 facing 192.168.1.0/24?
>  
>
Yes.  Although I am not running the script on this box.  Its  a plain 
Ipcop linux firewall.

> 
>  
>
>>I am running proftpd on (192.168.1.101) with the port set to 65437 and
>>with passive ports set to 50000-51000.  Proftpd allows you to specify a
>>range of ports to use on passive transfers.  I need to be able to limit
>>my outbound ftp traffic to 40 Kbytes per second.
>>The only way I can see to do this is limit by marking packets with
>>iptables.  I am marking traffic on 65436 which is the active ftp data
>>port (65437-1) and 50000-60000.  Outbound shaping is working
>>fine....however....inbound ftp traffic is also being shaped to 40K.  I
>>have no idea why.
>>
>>Seems to me the below rules should mark outbound packets and shape only
>>outbound packets.  I dont understand why inbound packets are getting shaped.
>>
>>Here is the script:
>>#!/bin/bash
>>#shaping passive and active outbound ftp traffic on an internal computer
>>without affecting inbound and lan speed
>>
>># mark the outbound passive ftp packets on ports 50000-51000
>>iptables -t mangle -N MYSHAPER-OUT
>>iptables -t mangle -I OUTPUT -o eth0 -j MYSHAPER-OUT
>>
>>iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 65436 -j MARK
>>--set-mark 20
>>iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 50000:51000 -j MARK
>>--set-mark 20
>>iptables -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 26
>>    
>>
>
>1) Are you sure these rules are correctly marking and that the marks
>exist at the time the tc filter sees the packet?  My hunch is NOT. 
>ASIDE: We _really_ need a way for filters to report hit counts!
>
>  
>
No, I am not sure.  I have used the command 'watch -n1 tc -s class ls 
dev eth0' to see the packets flying but i dont really know how to make 
sure they are being marked correctly.  I must assume that ALL packets on 
ports 65436 and 50000-510000 are being marked because they are being 
shaped.  Just not sure why incoming packets are being markek and 
shaped.  Outbound shaping is working just fine.

>2) Since 1:26 is htb default, why is it necessary to '--set-mark 26'?
>
>  
>
I thought it was necessary.

>gypsy
>_______________________________________________
>LARTC mailing list / LARTC@mailman.ds9a.nl
>http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
>  
>

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/