From mboxrd@z Thu Jan 1 00:00:00 1970 From: bartekR Date: Mon, 03 Sep 2007 13:58:11 +0000 Subject: [LARTC] Classes do not receive any traffic ? Message-Id: <46DC12F3.6010101@poczta.fm> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable To: lartc@vger.kernel.org Hello everyone. CONFIGURATION DESCRIPTION: I have a linux box doing masquerade for two lan's. Here is a piece of=20 mine network config: eth0 : ISP , one public ip address (DSL modem) eth1 : lan , private network address fe: 192.168.4.0/24 eth2 : wlan access point performing as lan2wlan bridge , private network=20 addes fe. 192.168.67.0/24 This box use 2.6.20 kernel with iptables-1.3.8 and=20 iproute-2.6.20-070313. I also use imq hooked as AB. I have tried to shape eth0's incoming traffic using imq0 : =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3Dstart=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ifconfig imq0 txqueuelen 30 up tc qdisc add dev imq0 root handle 1: htb ${root_parm} #this class have speed corresponding to maximum achieved speed of isp=20 connection in particular direction tc class add dev imq0 parent 1:0 classid 1:1 htb rate ${rate_sum} ceil ${rate_sum} burst 0kb cburst 0kb ${quantum_sum} # summarized prio class tc class add dev imq0 parent 1:1 classid 1:2 htb rate ${rate_prio_sum}=20 ceil ${rate_prio_sum} burst 0kb cburst 0kb ${quantum_prio_sum} #critical prio tc class add dev imq0 parent 1:2 classid 1:3 htb prio ${prio_crit} rate=20 ${rate_crit} ceil ${ceil_crit} burst 0kb cburst 0kb ${quantum_crit} tc filter add dev imq0 parent 1:0 protocol ip prio 0 u32 match mark 3=20 0xffff flowid 1:3 #prio voip tc class add dev imq0 parent 1:2 classid 1:4 htb prio ${prio_voip} rate=20 ${rate_voip} ceil ${ceil_voip} burst 0kb cburst 0kb ${quantum_voip} tc filter add dev imq0 parent 1:0 protocol ip prio 1 u32 match mark 4=20 0xffff flowid 1:4 #games tc class add dev imq0 parent 1:2 classid 1:5 htb prio ${prio_ent} rate=20 ${rate_ent} ceil ${ceil_ent} burst 0kb cburst 0kb ${quantum_ent} tc filter add dev imq0 parent 1:0 protocol ip prio 2 u32 match mark 5=20 0xffff flowid 1:5 # summarized class for generic unclassified traffic tc class add dev imq0 parent 1:1 classid 1:6 htb rate ${rate_user_sum}=20 ceil ${rate_user_sum} burst 0kb cburst 0kb ${quantum_user_sum} #generic server traffic tc class add dev imq0 parent 1:6 classid 1:7 htb prio ${prio_srv} rate=20 ${rate_srv} ceil ${ceil_srv} burst 0kb cburst 0kb ${quantum_srv} tc filter add dev imq0 parent 1:0 protocol ip prio 4 u32 match ip=20 ${dev[3]} $server_public_ip flowid 1:7 #default class tc class add dev imq0 parent 1:6 classid 1:8 htb prio 7 rate 1kbps ceil=20 1kbps burst 0kb cburst 0kb quantum 1500 # fe. single user class tc class add dev imq0 parent 1:6 classid 1:30 htb prio ${prio_user} rate=20 ${rate_user} ceil ${ceil_user} burst 0kb cburst 0kb ${quantum_user} tc filter add dev imq0 parent 1:0 protocol ip prio 5 u32 match ip=20 ${dev[3]} 192.168.4.5 flowid 1:30 =09 #Each user has his own class for traffic that were not classified for=20 #prio classes. Other traffic is probably traffic from "unofficial users=20 #so they receive what they deserve :). #This two functions are responsible for setting up iptables and imq hooking. skype()=20 =20 { #Nasty workaround for skype=20 =20 if [ ! -r /tmp/1 -o ! -r /tmp/2 ] ; then=09 touch /tmp/1 /tmp/2=20 =20 find /etc/l7-protocols/protocols/ -type f -name *pat |cut -d/ -f5 | cut=20 -d. -f1 >/tmp/1=20 sed=20 '/skype*/d;/finger*/d;/biff*/d;/whois*/d;/tsp*/d;/ntp*/d;/unknown*/d;/sip*/= d;/h232*/d;/teamspeak*/d;/ventrilo*/d;/ssh*/d;/jabber*/d;/aim*/d;/msnmessen= ger*/d;/yahoo*/d;/qq*/d;/battlefield1942/d;/battlefield2/d;/counterstrike-s= ource*/d;/dayofdefeat-source*/d;/doom3*/d;/halflife2-deathmatch*/d;/mohaa*/= d;/quake-halflife*/d;/quake1*/d;/worldofwarcraft*/d'=20 /tmp/1 > /tmp/2 fi i=3D`cat /tmp/2|wc -l`=20 =20 j=3D1=20 =20 iptables -t mangle -N ${dev[2]}_SKYPE=20 =20 iptables -t mangle -A ${dev[2]}_SKYPE -p tcp --sport 1:1024 -j RETURN=20 =20 iptables -t mangle -A ${dev[2]}_SKYPE -p udp --sport 1:1024 -j RETURN=20 =20 iptables -t mangle -A ${dev[2]}_SKYPE -p tcp --dport 1:1024 -j RETURN=20 =20 iptables -t mangle -A ${dev[2]}_SKYPE -p udp --dport 1:1024 -j RETURN=20 =20 while [ ${j} -le ${i} ]; do iptables -t mangle -A ${dev[2]}_SKYPE -m layer7 --l7proto `sed -n ${j}p=20 /tmp/2` -j RETURN=20 j=3D$(($j+1))=20 =20 done iptables -t mangle -A ${dev[2]}_SKYPE -m layer7 --l7proto skypetoskype=20 -j ${dev[2]}_CON_VOIP iptables -t mangle -A ${dev[2]}_SKYPE -m layer7 --l7proto skypeout -j=20 ${dev[2]}_CON_VOIP>/dev/null 1>/dev/null 2>/dev/null 3>/dev/null 4>/dev/null iptables -t mangle -A ${dev[2]}_SKYPE -j RETURN=20 } ipt_int() { iptables -t mangle -N ${dev[2]}_CHECK iptables -t mangle -N ${dev[2]}_IMQ iptables -t mangle -N ${dev[2]}_PRIO if [[ ${dev[0]} =3D~ 'imq0' ]] ; then iptables -t mangle -A ${dev[2]}_PRIO -j MARK --set-mark 3 elif [[ ${dev[0]} =3D~ 'eth0' ]] ; then iptables -t mangle -A ${dev[2]}_PRIO -j CLASSIFY --set-class 1:3 else exit 1 fi iptables -t mangle -A ${dev[2]}_PRIO -j ${dev[2]}_IMQ iptables -t mangle -N ${dev[2]}_CON_PRIO if [[ ${dev[0]} =3D~ 'imq0' ]] ; then iptables -t mangle -A ${dev[2]}_CON_PRIO -j MARK --set-mark 3 elif [[ ${dev[0]} =3D~ 'eth0' ]] ; then iptables -t mangle -A ${dev[2]}_CON_PRIO -j CLASSIFY --set-class 1:3 else exit 1 fi iptables -t mangle -A ${dev[2]}_CON_PRIO -j CONNMARK --save-mark iptables -t mangle -A ${dev[2]}_CON_PRIO -j ${dev[2]}_IMQ iptables -t mangle -N ${dev[2]}_CON_VOIP if [[ ${dev[0]} =3D~ 'imq0' ]] ; then iptables -t mangle -A ${dev[2]}_CON_VOIP -j MARK --set-mark 4 elif [[ ${dev[0]} =3D~ 'eth0' ]] ; then iptables -t mangle -A ${dev[2]}_CON_VOIP -j CLASSIFY --set-class 1:4 else echo co=C5=9B nie tak w 'ip_int()' exit 1 fi iptables -t mangle -A ${dev[2]}_CON_VOIP -j CONNMARK --save-mark iptables -t mangle -A ${dev[2]}_CON_VOIP -j ${dev[2]}_IMQ iptables -t mangle -N ${dev[2]}_CON_GRY if [[ ${dev[0]} =3D~ 'imq0' ]] ; then iptables -t mangle -A ${dev[2]}_CON_GRY -j MARK --set-mark 5 elif [[ ${dev[0]} =3D~ 'eth0' ]] ; then iptables -t mangle -A ${dev[2]}_CON_GRY -j CLASSIFY --set-class 1:5 else exit 1 fi iptables -t mangle -A ${dev[2]}_CON_GRY -j CONNMARK --save-mark iptables -t mangle -A ${dev[2]}_CON_GRY -j ${dev[2]}_IMQ iptables -t mangle -N ${dev[2]}_GRY if [[ ${dev[0]} =3D~ 'imq0' ]] ; then iptables -t mangle -A ${dev[2]}_GRY -j MARK --set-mark 5 elif [[ ${dev[0]} =3D~ 'eth0' ]] ; then iptables -t mangle -A ${dev[2]}_GRY -j CLASSIFY --set-class 1:5 else exit 1 fi iptables -t mangle -A ${dev[2]}_GRY -j ${dev[2]}_IMQ iptables -t mangle -A ${dev[2]}_CHECK -m length --length 1:64 -p tcp=20 --tcp-flags SYN,FIN,ACK ACK -j ${dev[2]}_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p tcp --tcp-flags SYN,ACK,FIN SYN=20 -j ${dev[2]}_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p tcp --tcp-flags SYN,ACK,FIN=20 SYN,ACK -j ${dev[2]}_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p tcp --tcp-flags SYN,ACK,FIN=20 FIN,ACK -j ${dev[2]}_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p icmp --icmp-type echo-request=20 -j ${dev[2]}_GRY iptables -t mangle -A ${dev[2]}_CHECK -p icmp --icmp-type echo-reply -j=20 ${dev[2]}_GRY iptables -t mangle -A ${dev[2]}_CHECK -j CONNMARK --restore-mark iptables -t mangle -A ${dev[2]}_CHECK -m mark ! --mark 0 -j ${dev[2]}_IMQ iptables -t mangle -A ${dev[2]}_CHECK -p tcp -m multiport --ports=20 22,53,65522 -j ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p udp -m multiport --ports=20 22,53,65522 -j ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p tcp -m iprange=20 --${dev[4]}-range 217.17.41.80-217.17.41.95 -m multiport=20 --${dev[6]}ports 8074,443 -j ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -p tcp -m iprange=20 --${dev[4]}-range 217.17.45.128-217.17.45.159 -m multiport=20 --${dev[6]}ports 8074,443 -j ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto ssh -j=20 ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto sip -j=20 ${dev[2]}_CON_VOIP iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto h323 -j=20 ${dev[2]}_CON_VOIP iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto teamspeak -j=20 ${dev[2]}_CON_VOIP iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto ventrilo -j=20 ${dev[2]}_CON_VOIP iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto jabber -j=20 ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto aim -j=20 ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto msnmessenger=20 -j ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto yahoo -j=20 ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto qq -j=20 ${dev[2]}_CON_PRIO iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto=20 battlefield1942 -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto battlefield2=20 -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto=20 counterstrike-source -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto=20 dayofdefeat-source -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto doom3 -j=20 ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto=20 halflife2-deathmatch -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto mohaa -j=20 ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto quake-halflife=20 -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto quake1 -j=20 ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -m layer7 --l7proto=20 worldofwarcraft -j ${dev[2]}_CON_GRY =09 skype =09 iptables -t mangle -A ${dev[2]}_CHECK -j ${dev[2]}_SKYPE iptables -t mangle -A ${dev[2]}_CHECK -p tcp -m multiport --ports=20 27000:27030,28960 -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -p udp -m multiport --ports=20 27000:27030,27901,27960,28960,28960,28960,14567,16567 -j ${dev[2]}_CON_GRY iptables -t mangle -A ${dev[2]}_CHECK -j ${dev[2]}_IMQ =09 iptables -t mangle -N ${dev[2]}_KONIEC iptables -t mangle -A ${dev[2]}_KONIEC -j RETURN =09 if [[ ${dev[0]} =3D~ 'imq(.*)' ]] ; then export numdev=3D${BASH_REMATCH[1]} iptables -t mangle -A ${dev[2]}_IMQ -j IMQ --todev ${numdev} fi iptables -t mangle -A ${dev[2]}_IMQ -j ${dev[2]}_KONIEC if [[ ${dev[2]} =3D~ 'DL' ]] ; then iptables -t mangle -I ${dev[7]} -i ${dev[1]} -j ${dev[2]}_CHECK elif [[ ${dev[2]} =3D~ 'UL' ]] ; then iptables -t mangle -I ${dev[7]} -o ${dev[1]} -j ${dev[2]}_CHECK else exit 1 fi } # Before invoking any function i setup correct data to dev vector: #example export dev=3D(imq0 eth0 DL dst src d s PREROUTING) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3Dstop=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D I know that my script is really complex one. Check this simplified=20 diagram to understand general idea: -----| P | R | E R| O| /=3DYES=3D>[prio]=3D> O U| || R T|=3D>(?mark!=3D0?)=3DNO=3D>(?prio?)=3DNO=3D>(?valid user?)=3DNO=3D>[de= f]=3D> I| || || P N| \=3DYES=3D> \=3DYES=3D>[user]=3D> O G| S | T | -----| [] - classifying for proper class (mark or u32) - packet travels to imq or leaves PRE,POSTROUTING QUESTIONS AND PROBLEM DESCRIPTION: 1.Main problem. It seems that classes on imq0 that should shape incoming traffic from=20 internet do not recognizes marks. Fw match don't work. U32 match works=20 except matching marks. The only classes that receive traffic on imq0 are=20 server class and user classes. Similar problem occurred on eth0(upload)=20 but I managed to solve this problem by using -j CLASSIFY instead -j=20 MARK. When I tried to fix this problem I have learned that this may be=20 caused by the way tc and iptables are works together.I am sure that=20 marks are set and IMQ target works (non zero iptables/ifconfig counters)=20 . I think that it is possible for u32 matches to classify traffic before=20 any mark is set. Unfortunately kptd is out of date so it is not certain=20 to me. Would somebody explain me why fwmark do not work on imq0 ? 2. I have found that when i try to ping from host in lan to host in=20 internet every fifth icmp packet has significantly higher delay. F.e.=20 four packets goes trough with delay approx 15ms but next packet have=20 delay up to 100ms ! I suppose that it may be caused by to big txqueuelen=20 so i decreased it from 1000 to 30 on all interfaces without any problems=20 with lesser bandwidth or packet looses. Could somebody advice proper=20 value for txqueuelen if it was a good idea to change it. I have 1Mbit/256kbit DSL modem. 3. Is it a good idea to set proper ToS value for a outbound traffic that=20 was classified as prio ?? Would it give any decrease in delays ?? I hope I will find someone helpful and also very tolerant for mine poor=20 English ... Posting on LTARC is the only way to solve mine problems.... Bartek ---------------------------------------------------------------------- Bedac w WC czytala wiadomosci. >>> http://link.interia.pl/f1b71 _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc