From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mohan Sundaram Date: Mon, 06 Nov 2006 04:17:08 +0000 Subject: Re: [LARTC] Ingress qdisc bypassed on SNAT'ed traffic? Message-Id: <454EB474.4050702@vsnl.com> List-Id: References: <355a4e960611051946s4759a7c2k5e8dbe9aa3755342@mail.gmail.com> In-Reply-To: <355a4e960611051946s4759a7c2k5e8dbe9aa3755342@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org EKC wrote: > Hello, > However, the same lartc ingress filter rules work fine when run on the > NAT gateway address (10.32.4.2). The QoS processing is done just before the device queue for egress or immediately after ingress from the device. Thus using the 192.168.x.x addresses for tc filters will not work. Using the gateway address works as that is the IP on the incoming packet's header. > > I suppose this means that the ingress filter is being run too early in > the PREROUTING chain to catch the NAT'ed destination address. Is there > a patch to change this behaviour? I've not seen one. > > I've also tried using connmark to no avail. Ingress QoS works much before packet hits all this stuff. > > I would rather avoid using IMQ since my ingress QOS needs are pretty > simple. AFAIK, there is no other choice/way here. > > Any suggestions? One wa of doing this is to use one NAT IP per subnet and shape based on that NAT IP for ingress. However, this assumes you have as many addresses on the gateway as the subnet. I'm using you do as the NAT'ted IP is also a RFC1918 address. That leads to a more basic question - why NAT when both are RFC1918 addresses? Mohan _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc