All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Taylor, Grant" <gtaylor@riverviewtech.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] OpenSwan traffic shaping with HTB & sfq
Date: Wed, 04 May 2005 16:45:15 +0000	[thread overview]
Message-ID: <4278FC1B.8040202@riverviewtech.net> (raw)
In-Reply-To: <0C8098CA7F09CE419F0C2B68EB83587648B89C@exchange.fasttrack.net.au>

> Hi All,
> 
> I've got an interoffice IPSEC VPN in place that I'm trying to give
> priority to terminal service (tcp 3389) traffic.
> I've created rules at each end, but have hit a bit of a dillemma.  As
> the data is encrypted I must also give highest priority to protocol 50
> otherwise the priority is lost as the packet gets encrypted.  
> When I do this however, I can't slow people dragging large files across
> the VPN and disrupting the Terminal users. 
> This is an example of some of the rules in place.  I can protect the VPN
> traffic from other internet traffic such as email etc, but not from
> themselves if you know what I mean.

I /think/ that there are some patches for OpenS/WAN that change where the traffic passing through the VPN gets encrypted such that you could QoS / TC the traffic for just RDP.  I think this patch works by having the traffic that will pass through the VPN pass through the kernel a couple of times.  One pass is for the (unencrypted) traffic to go through the kernel and out through all normal filters / qdisc / classes etc and then get encrypted and loop back through the kernel as encrypted traffic so that it can go through the kernel and out through all normal filters / qdisc / classes etc.  This is exactly what these patches are for.  I personally have not applied these patches, but have read about them in some stopper at some whee hour of the morning.



Grant. . . .
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

      parent reply	other threads:[~2005-05-04 16:45 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2005-05-04  7:34 [LARTC] OpenSwan traffic shaping with HTB & sfq Lewis Shobbrook
2005-05-04  7:48 ` Sylvain BERTRAND
2005-05-04 16:45 ` Taylor, Grant [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4278FC1B.8040202@riverviewtech.net \
    --to=gtaylor@riverviewtech.net \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.