Re: using iptables to speed limit connections

[Andrew Beverley <andy@andybev.com>]

On Wed, 2011-10-26 at 14:44 +0100, J Webster wrote:
> On 26/10/2011 14:20, Jon Lewis wrote:
> > On Wed, 26 Oct 2011, J Webster wrote:
> >
> >> Is there any easy way to speed limit connections on a VPN to 2 Mbps?

Not really any easy way that I am aware of...

> >> My server is 100Mbps but I have connections on a VPN of 10.8.0.0. so 
> >> need to limit the outbound connection from 10.8.0.0 to 2 Mbps.
> >> I tried reading the stuff on leaf but the tutorial doesn't seem very 
> >> straightforward and there is not much information on this on the net.

Agreed.

> >
> > You probably should have a look at 
> > http://lartc.org/howto/lartc.qdisc.html

<Top posting fixed>

> The problem is not so much limiting the overall connection but limiting 
> the connection of each individual vpn user to 2Mbps.
> So, there is 100Mbps to share between 10 users, they should each get 2, 
> giving a use of 20Mbps.

In which case you'll need a classful qdisc. HTB is probably a good place
to start. You'll need a leaf class for each user, and you'll need to add
a filter for each one, probably by IP address from what you've already
said (or you can do using a netfilter mark using flowid)

> Also, I wasn't sure from those pages whether this should be applied to 
> each IP on the VPN network 10.8.0.0/24 or every IP with outgoing packets 
> but that would then limit the server to 2 Mbps.

If I'm reading correctly, I suggest you'll need one HTB qdisc on your
outbound interface, with a leaf class for each IP on the VPN network.

I've found these pages very helpful:

http://www.opalsoft.net/qos/DS.htm

See how you get on, and if you need more help then please shout.

Andy