[LARTC] Incoming trafic shaping (depending on src IP)

[Oki DZ okidz@telkom.net]

<PRE>On Tue, 20 Feb 2001, Spyou wrote:
&gt;<i> i'm trying to shape incoming trafic on my linux box.
</I>
I think putting the following on your system is a must:
<A HREF="http://defiant.coinet.com/iproute2/equinox/cbq_init.html">http://defiant.coinet.com/iproute2/equinox/cbq_init.html</A>
 
&gt;<i> I want it to depend on the source IP adress of the packets (in fact, i got 
</I>&gt;<i> a VPN on an ADSL link and wanted to get at least/max 64Kbit/s for the VPN)
</I>&gt;<i> 
</I>&gt;<i> So i tried this :
</I>[all those commands that would make iproute newbies like hitting a thick
wall at 100mph; and after two weeks, the wall is as thick as before;
deleted] 

&gt;<i> Okay, so, with this, packets comming trought ppp0 and from &lt;the SRC IP of 
</I>&gt;<i> my VPN&gt; should be shaped at 64Kbit/s, right ?
</I>
It is explained that iproute limits outgoing bandwidth only (&quot;outgoing&quot;
if seen _from_ your net devices). Recently, I tried something that seems
to be working; my setup:

          128Kbit      100Mbit  
[Internet]-------[eth1]-------[eth0]
                              192.168.1.x
                              Squid

I wanted to limit web access to about 40Kbit. The entry file for cbq.init:
DEVICE=eth0,100Mbit,10Mbit
RATE@Kbit
WEIGHT=4Kbit
PRIO=7
RULE=:80,192.168.1.x
BOUNDED=no
ISOLATED=yes

Meaning: the device used is eth0, at 100Mbit. Transfer rate is at 40Kbit. 
The traffic from port 80, from any addresses that go to 192.168.1.x, will
use 40Kbit, at least. It is unbounded, so if the line still permits
(128Kbit), the traffic from port 80 would borrow the remaining bandwidth.
But the limiter has priority of 7, which will release the borrowed
bandwidth to any higher (1-6) priority limiters.

I thought that this setting wouldn't work. But it seems that iproute
limits the traffic &quot;from eth0 to 192.168.1.x&quot;; which, in a sense, is
&quot;outgoing&quot;.

I monitor the traffic using MRTG, the graphs are fine. And also, cbg.init
has &quot;stats&quot; command so you can see which unbounded limiters that borrow
bandwidth from the others.  

&gt;<i> Where's my error ? 
</I>
For not using cbq.init...?

&gt;<i>Is there something more simple (eg. with iptables and 
</I>&gt;<i> packet marking ?)
</I>
You can use iptables along with cbq.init (no, cbq.init doesn't support
packet marking yet); all you need is to name the entry-files correctly
(the names become the classid of the limiters), and then execute iptables
for packet filtering after cbq.init (use the flowid's accordingly;
according to the entry-file names).

Oki
ps: the above cbq.init's config would have problem if the machine accessed
other internal machines at port 80; so the web traffic would be limited
also.  But for the problem that was at hand, is no problem. 
 
--
					So much free software
					So little time...



</PRE>