Re: Fair queuing with htb

[Andrew Beverley <andy@andybev.com>]

On Sat, 2010-12-25 at 04:51 +0100, Grégoire Leroy wrote:
> Le Saturday 25 December 2010 03:35:12, Antoine Souques a écrit :
> > > I've attached a graph which explains what are the marked packets.
> > 
> > Your design is wrong. You mark the upload traffic, when the main http
> > traffic is the download traffic. That is why your QoS seems ineffective
> 
> In this case I have probably misunderstood the goal of the tcp_outgoing_mark 
> squid directive. Andrew, in what purpose is it developped ?
> 

tcp_outgoing_mark will mark packets going from squid to the webserver.
If you want to mark packets going from squid to your client then you
need to use clientside_mark instead.

> > 
> > > The general goal is to do a QoS based on user ip. If I had no proxy, it
> > > would be easy. However, since I've a proxy, my firewall sees the proxy
> > > ip, not the users IP.
> > 
> > Where is your firewall ? Between the proxy and the webserver, or the
> > otherside ?
> > 
> 
> Yes it is
> 
> > In the first case, you can only mark the upload traffic (it's to late
> > for the download traffic). You should use the conntrack module to mark a
> > connection, and so, you will be able to mark the download traffic
> 
> I thank it was the goal of the tcp_outgoing_mark squid directive (authored by 
> Andrew).
> 

If you're going to mark packets on the other side of Squid, then you'll
probably need to move the interface that your HTB qdisc is attached to.

> > Moreover, I don't understand why you don't have access to your user
> > addresses. You use mark, so your firewall and your proxy are running on
> > the same box. So, when the download traffic leaves your proxy/firewall,
> > the destination adsress is the user address. tc is called when a packet
> > is send to the network, or when a packet arrive. So you can do IP based
> > QoS.
> 
> The problem is if I limit the traffic between the proxy and users, then he 
> won't any difference between the data downloaded from internet and the data 
> which was in cache in squid.
> 
> I want to limit the rate only for non-cached data, so it seems relevant to 
> apply QoS between proxy server and internet.
> 

In which case you want qos_flows, as Amos has already pointed out.

Andy