From mboxrd@z Thu Jan 1 00:00:00 1970 From: "George Peverill" Subject: I have to become a bandwidth Nazi , Netfilter useable. Date: Sat, 1 Mar 2003 09:57:43 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000201c2dffa$8ad18480$0c05a8c0@Sherby> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C2DFD9.03BFE480" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C2DFD9.03BFE480 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I am running a small network (about 10-12 machines) with a linux gateway machine providing http/ssh/vpn(pptp)/firewalling/NAT Recently we've had someone that loves to hog bandwidth a tad (ie: downloading movies at 150-200k/s) while we slave away with the remaining 50k/s or so of bandwidth. I was wondering and I think its possible) if I could remedy this without resorting to compilicated QoS / CBQ crap. Basically is it possible to write a rule that'd say drop 25% or maybe 50% of all packets going to his machine from the gateway? (nasty yes agreed) -internal interface is eth0 (192.168.0.x) -external interface is eth1 Is it possible to do it based on his IP (which is known lets say 192.168.0.55 for example sake) or his MAC address which is known. Any help would be greatly appreciated. I dunno how this can be done but im sure someone might be able to figure it out , would have to be done in the PREROUTING where SNAT is done wouldnt it ? ------=_NextPart_000_0003_01C2DFD9.03BFE480 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message
 
I am = running a small=20 network (about 10-12 machines) with a linux gateway machine providing=20 http/ssh/vpn(pptp)/firewalling/NAT
Recently we've had=20 someone that loves to hog bandwidth a tad (ie: downloading movies at = 150-200k/s)=20 while we slave away
with = the remaining=20 50k/s or so of bandwidth.  I was wondering and I think its = possible) if I=20 could remedy this without resorting
to = compilicated QoS=20 / CBQ crap.  Basically is it possible to write a rule that'd say = drop 25%=20 or maybe 50% of all packets going to his machine from the gateway? = (nasty yes=20 agreed)
 
-internal interface=20 is eth0 (192.168.0.x)
-external interface=20 is eth1
 
Is it = possible to do=20 it based on his IP (which is known lets say 192.168.0.55 for example = sake) or=20 his MAC address which is known.
 
Any = help would be=20 greatly appreciated.  I dunno how this can be done but im sure = someone=20 might be able to figure it out , would have to be done in the PREROUTING = where=20 SNAT is done wouldnt it ?
 
 
------=_NextPart_000_0003_01C2DFD9.03BFE480-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Newkirk Subject: Re: I have to become a bandwidth Nazi , Netfilter useable. Date: Sat, 1 Mar 2003 10:19:00 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200303011019.00158.netfilter@newkirk.us> References: <000201c2dffa$8ad18480$0c05a8c0@Sherby> Reply-To: netfilter@newkirk.us Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <000201c2dffa$8ad18480$0c05a8c0@Sherby> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: George Peverill , netfilter@lists.netfilter.org On Saturday 01 March 2003 08:57 am, George Peverill wrote: > I am running a small network (about 10-12 machines) with a linux > gateway machine providing http/ssh/vpn(pptp)/firewalling/NAT > Recently we've had someone that loves to hog bandwidth a tad (ie: > downloading movies at 150-200k/s) while we slave away > with the remaining 50k/s or so of bandwidth. I was wondering and I > think its possible) if I could remedy this without resorting > to compilicated QoS / CBQ crap. Basically is it possible to write a > rule that'd say drop 25% or maybe 50% of all packets going to his > machine from the gateway? (nasty yes agreed) > > -internal interface is eth0 (192.168.0.x) > -external interface is eth1 > > Is it possible to do it based on his IP (which is known lets say > 192.168.0.55 for example sake) or his MAC address which is known. Match in FORWARD chain (BEFORE any ACCEPT rules) with "-d 192.168.0.55",=20 and also possibly with "-p tcp --dport " with the port that=20 the traffic goes to, or "--sport" with the port the traffic comes from. =20 (this depends on the p2p app he's using) You can use the limit match to=20 specify a fixed number of packets in a specified period of time, but not=20 a percentage. You'd need to figure out how many packets per second to=20 set as a maximum. You may find that DROP doesn't help much, though, as it's likely his p2p=20 client will just keep requesting data, and the source will just keep=20 pumping it through as fast as it's able to. You might be better served=20 by Arnt Karlsen's favored approach - the TARPIT target from=20 patch-o-matic, or my favorite - whack him on the head with a keyboard. It also might help to use the similar dport/sport+sourceIP+limit approach= =20 to restrict how many requests his p2p client can send out in a given=20 timeframe, as well as upload traffic. (many p2p clients force, or=20 strongly encourage [IE by limiting download to 4x upload] allowing=20 uploads from the client) > Any help would be greatly appreciated. I dunno how this can be done > but im sure someone might be able to figure it out , would have to be > done in the PREROUTING where SNAT is done wouldnt it ? No, this is filtering and should be done in the filter table, in this=20 case the FORWARD chain. j From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnt Karlsen Subject: Re: I have to become a bandwidth Nazi , Netfilter useable. Date: Sat, 1 Mar 2003 18:50:29 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030301185029.66e15b7a.arnt@c2i.net> References: <000201c2dffa$8ad18480$0c05a8c0@Sherby> <200303011019.00158.netfilter@newkirk.us> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200303011019.00158.netfilter@newkirk.us> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Sat, 1 Mar 2003 10:19:00 -0500, Joel Newkirk wrote in message <200303011019.00158.netfilter@newkirk.us>: > On Saturday 01 March 2003 08:57 am, George Peverill wrote: > > I am running a small network (about 10-12 machines) with a linux > > gateway machine providing http/ssh/vpn(pptp)/firewalling/NAT > > Recently we've had someone that loves to hog bandwidth a tad (ie: > > downloading movies at 150-200k/s) while we slave away > > with the remaining 50k/s or so of bandwidth. I was wondering and I > > think its possible) if I could remedy this without resorting > > to compilicated QoS / CBQ crap. Basically is it possible to write a > > rule that'd say drop 25% or maybe 50% of all packets going to his > > machine from the gateway? (nasty yes agreed) > > > > -internal interface is eth0 (192.168.0.x) > > -external interface is eth1 > > > > Is it possible to do it based on his IP (which is known lets say > > 192.168.0.55 for example sake) or his MAC address which is known. > > Match in FORWARD chain (BEFORE any ACCEPT rules) with "-d > 192.168.0.55", and also possibly with "-p tcp --dport " > with the port that the traffic goes to, or "--sport" with the port the > traffic comes from. (this depends on the p2p app he's using) You can > use the limit match to specify a fixed number of packets in a > specified period of time, but not a percentage. You'd need to figure > out how many packets per second to set as a maximum. > > You may find that DROP doesn't help much, though, as it's likely his > p2p client will just keep requesting data, and the source will just > keep pumping it through as fast as it's able to. You might be better > served by Arnt Karlsen's favored approach - the TARPIT target from > patch-o-matic, or my favorite - whack him on the head with a keyboard. > > It also might help to use the similar dport/sport+sourceIP+limit > approach to restrict how many requests his p2p client can send out in > a given timeframe, as well as upload traffic. (many p2p clients > force, or strongly encourage [IE by limiting download to 4x upload] > allowing uploads from the client) > > > Any help would be greatly appreciated. I dunno how this can be done > > but im sure someone might be able to figure it out , would have to > > be done in the PREROUTING where SNAT is done wouldnt it ? > > No, this is filtering and should be done in the filter table, in this > case the FORWARD chain. > > j > > ..also, check out http://tldp.org/HOWTO/Adv-Routing-HOWTO/ -- ..med vennlig hilsen = with Kind Regards from Arnt... ;-) ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kelly Setzer Subject: Re: I have to become a bandwidth Nazi , Netfilter useable. Date: Sat, 1 Mar 2003 09:34:03 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030301153403.GA27466@placemark.com> References: <000201c2dffa$8ad18480$0c05a8c0@Sherby> <200303011019.00158.netfilter@newkirk.us> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <200303011019.00158.netfilter@newkirk.us> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Saturday 01 March 2003 08:57 am, George Peverill wrote: > I am running a small network (about 10-12 machines) with a linux > gateway machine providing http/ssh/vpn(pptp)/firewalling/NAT > Recently we've had someone that loves to hog bandwidth a tad (ie: > downloading movies at 150-200k/s) while we slave away If you have a manageable switch, manually set his switch port to half-duplex. That will have the desired effect and can be conveniently explained away if he ever causes problems for you. Kelly From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kelly Setzer Subject: Re: I have to become a bandwidth Nazi , Netfilter useable. Date: Sat, 1 Mar 2003 09:38:00 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030301153800.GC27466@placemark.com> References: <000201c2dffa$8ad18480$0c05a8c0@Sherby> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <000201c2dffa$8ad18480$0c05a8c0@Sherby> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Sat, Mar 01, 2003 at 09:57:43AM -0400, George Peverill wrote: > > I am running a small network (about 10-12 machines) with a linux gateway > machine providing http/ssh/vpn(pptp)/firewalling/NAT > Recently we've had someone that loves to hog bandwidth a tad (ie: To clarify - the switch should be half-duplex while his computer remains full duplex. Quite often, ethernet cards will not redo nway autonegation once the link is up. Sometimes they do, at which point he'd just have a normal half-duplex link which doesn't really slow him down very much relative to your upstream bandwidth. Kelly