From mboxrd@z Thu Jan 1 00:00:00 1970 From: nix4me Date: Sat, 27 Nov 2004 13:40:22 +0000 Subject: Re: [LARTC] outbound shaping Message-Id: <41A883C6.1040509@cfl.rr.com> List-Id: References: <41A3FECE.4070507@cfl.rr.com> In-Reply-To: <41A3FECE.4070507@cfl.rr.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org gypsy wrote: >Andy Furniss wrote: > > >>>>>I am running proftpd on (192.168.1.101) with the port set to 65437 and >>>>>with passive ports set to 50000-51000. Proftpd allows you to specify a >>>>>range of ports to use on passive transfers. I need to be able to limit >>>>>my outbound ftp traffic to 40 Kbytes per second. >>>>> >>>>> >>Could you post the bits of the proftpd config that do this - I have (but >>rarely use) proftpd and could test. >> >> >> >>>>>The only way I can see to do this is limit by marking packets with >>>>>iptables. I am marking traffic on 65436 which is the active ftp data >>>>>port (65437-1) and 50000-60000. Outbound shaping is working >>>>>fine....however....inbound ftp traffic is also being shaped to 40K. I >>>>>have no idea why. >>>>> >>>>> >>Is this when there is ftp traffic both ways or just inbound? >> >> >> >>>>>Seems to me the below rules should mark outbound packets and shape only >>>>>outbound packets. I dont understand why inbound packets are getting >>>>>shaped. >>>>> >>>>>Here is the script: >>>>>#!/bin/bash >>>>>#shaping passive and active outbound ftp traffic on an internal computer >>>>>without affecting inbound and lan speed >>>>> >>>>># mark the outbound passive ftp packets on ports 50000-51000 >>>>>iptables -t mangle -N MYSHAPER-OUT >>>>>iptables -t mangle -I OUTPUT -o eth0 -j MYSHAPER-OUT >>>>> >>>>>iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 65436 -j MARK >>>>>--set-mark 20 >>>>>iptables -t mangle -A MYSHAPER-OUT -p tcp --sport 50000:51000 -j MARK >>>>>--set-mark 20 >>>>>iptables -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK >>>>>--set-mark 26 >>>>> >>>>> >>>>> >>>>1) Are you sure these rules are correctly marking and that the marks >>>>exist at the time the tc filter sees the packet? My hunch is NOT. >>>>ASIDE: We _really_ need a way for filters to report hit counts! >>>> >>>> >>>> >>>> >>>> >>>No, I am not sure. I have used the command 'watch -n1 tc -s class ls >>>dev eth0' to see the packets flying but i dont really know how to make >>>sure they are being marked correctly. I must assume that ALL packets on >>>ports 65436 and 50000-510000 are being marked because they are being >>>shaped. Just not sure why incoming packets are being markek and >>>shaped. Outbound shaping is working just fine. >>> >>> >>You can see counters for iptables rules with iptables -t mangle -L -v -n >> >>Andy. >> >> > >I have been thinking about this without getting much of anywhere, but >here's what I think. > >Let me start by paraphasing your setup: >You have a cable modem that is connecting to a NATting box that runs >only IPCOP. This IPCOP box forwards everything to the LAN. On the LAN >side of IPCOP all the packets you wish to shape have an IP ending >1.101. The computer with IP 1.100 can be ignored for shaping purposes. > >If you MARK in iptables on IPCOP, I think the mark is internal only so >that 101 will never see the mark. You may not even be able to MARK on >the IPCOP box (I know nothing of IPCOP). If you are able to on the >IPCOP machine, consider setting the TOS field in the mangle table for >externally initiated FTP such that either all bits are on or all are off >(or some other unique value); then on 101 examine TOS and MARK >appropriately on the 101 machine or, preferably, just u32 match the TOS >there. > >If mangling TOS on IPCOP is possible and fruitful, be sure to do your >homework regarding mangle and PREROUTING (or whatever chain does what >you need). > >The IPCOP computer will "know" by the interface and --dport / --sport >which FTP sessions were initiated from the internet versus those >initiated on your LAN, but I can't see how 101 ever could. IPCOP might >also run one or more of netfilter's conntracks for FTP if that were >needed. > >If I come up with anything after sleeping on this, I'll let you know. >But for now the above is all I can conceive. > >gyxpy > > > You are correct on my setup. I am currently trying the addition that Andy recommended and it appears to be working. I am marking the ACK packets from the uploader and it seems to be fine now. No slow down for uploads and outbound is shaped nicely. I will continue to test to make sure everything is AOK. Mark _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/