* Traffic limitation with iptables
@ 2003-07-22 16:08 Xemul
2003-07-23 0:19 ` Arnt Karlsen
0 siblings, 1 reply; 6+ messages in thread
From: Xemul @ 2003-07-22 16:08 UTC (permalink / raw)
To: netfilter
Hi.
I wanna solve such a problem:
When I see that byte counter on some chain reaches or exceedes any fixed
value - then IMMEDIATELY insert into that cahin new first rule (e.g. -j
DROP) or delete some rules from any other chain. Or more abstract - how
can can discover that byte counter is higher than smth without
"polling" chains?
Sorry for sending such a mail into announce, developers and user
maillists but I need help as soon as possible. :)
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Traffic limitation with iptables
@ 2003-07-22 22:07 George Vieira
2003-07-22 22:16 ` Esteban Ribicic
2003-07-23 15:17 ` Xemul
0 siblings, 2 replies; 6+ messages in thread
From: George Vieira @ 2003-07-22 22:07 UTC (permalink / raw)
To: Xemul, netfilter
Use the Quota patch and it'll limit the rule by itself..
Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au
Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au
-----Original Message-----
From: Xemul [mailto:epv_xemul@mail.ru]
Sent: Wednesday, July 23, 2003 2:09 AM
To: netfilter@lists.netfilter.org
Subject: Traffic limitation with iptables
Hi.
I wanna solve such a problem:
When I see that byte counter on some chain reaches or exceedes any fixed
value - then IMMEDIATELY insert into that cahin new first rule (e.g. -j
DROP) or delete some rules from any other chain. Or more abstract - how
can can discover that byte counter is higher than smth without
"polling" chains?
Sorry for sending such a mail into announce, developers and user
maillists but I need help as soon as possible. :)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Traffic limitation with iptables
2003-07-22 22:07 Traffic limitation with iptables George Vieira
@ 2003-07-22 22:16 ` Esteban Ribicic
2003-07-23 15:17 ` Xemul
1 sibling, 0 replies; 6+ messages in thread
From: Esteban Ribicic @ 2003-07-22 22:16 UTC (permalink / raw)
To: George Vieira; +Cc: epv_xemul, netfilter
that would not be shapping...ass dropping/rejecting packets implicates
much more yhing under tcp/ip..
maybe lartc.org may help too..(this is not the mailing-list i think)
fix me if im wrong
Esteban
On Wed, 23 Jul 2003 08:07:40 +1000
"George Vieira" <georgev@citadelcomputer.com.au> wrote:
> Use the Quota patch and it'll limit the rule by itself..
>
> Thanks,
> ____________________________________________
> George Vieira
> Systems Manager
> georgev@citadelcomputer.com.au
>
> Citadel Computer Systems Pty Ltd
> http://www.citadelcomputer.com.au
>
>
>
> -----Original Message-----
> From: Xemul [mailto:epv_xemul@mail.ru]
> Sent: Wednesday, July 23, 2003 2:09 AM
> To: netfilter@lists.netfilter.org
> Subject: Traffic limitation with iptables
>
>
> Hi.
> I wanna solve such a problem:
> When I see that byte counter on some chain reaches or exceedes any fixed
> value - then IMMEDIATELY insert into that cahin new first rule (e.g. -j
> DROP) or delete some rules from any other chain. Or more abstract - how
> can can discover that byte counter is higher than smth without
> "polling" chains?
>
> Sorry for sending such a mail into announce, developers and user
> maillists but I need help as soon as possible. :)
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Traffic limitation with iptables
@ 2003-07-22 23:17 George Vieira
0 siblings, 0 replies; 6+ messages in thread
From: George Vieira @ 2003-07-22 23:17 UTC (permalink / raw)
To: Esteban Ribicic; +Cc: epv_xemul, netfilter
Well sorry. I can't understand your question.
" some chain reaches or exceedes any fixed value then IMMEDIATELY insert into that cahin new first rule (e.g. -j DROP)"
The Subject says "traffic limiting" but nothing in your body says dropping after an exceeded limit which is what QUOTA does.. you do not DROP packets as such with shaping, it merely puts them into a QUEUE and only on a congested network is where DROPing occurs.
what you want is TC which is part of iproute2 to do proper bandwidth throttling or use Bandwidth Arbitrator www.bandwidtharbitrator.com which is pretty good.
Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au
Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au
-----Original Message-----
From: Esteban Ribicic [mailto:eribicic@sinectis.com]
Sent: Wednesday, July 23, 2003 8:16 AM
To: George Vieira
Cc: epv_xemul@mail.ru; netfilter@lists.netfilter.org
Subject: Re: Traffic limitation with iptables
that would not be shapping...ass dropping/rejecting packets implicates
much more yhing under tcp/ip..
maybe lartc.org may help too..(this is not the mailing-list i think)
fix me if im wrong
Esteban
On Wed, 23 Jul 2003 08:07:40 +1000
"George Vieira" <georgev@citadelcomputer.com.au> wrote:
> Use the Quota patch and it'll limit the rule by itself..
>
> Thanks,
> ____________________________________________
> George Vieira
> Systems Manager
> georgev@citadelcomputer.com.au
>
> Citadel Computer Systems Pty Ltd
> http://www.citadelcomputer.com.au
>
>
>
> -----Original Message-----
> From: Xemul [mailto:epv_xemul@mail.ru]
> Sent: Wednesday, July 23, 2003 2:09 AM
> To: netfilter@lists.netfilter.org
> Subject: Traffic limitation with iptables
>
>
> Hi.
> I wanna solve such a problem:
> When I see that byte counter on some chain reaches or exceedes any fixed
> value - then IMMEDIATELY insert into that cahin new first rule (e.g. -j
> DROP) or delete some rules from any other chain. Or more abstract - how
> can can discover that byte counter is higher than smth without
> "polling" chains?
>
> Sorry for sending such a mail into announce, developers and user
> maillists but I need help as soon as possible. :)
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Traffic limitation with iptables
2003-07-22 16:08 Xemul
@ 2003-07-23 0:19 ` Arnt Karlsen
0 siblings, 0 replies; 6+ messages in thread
From: Arnt Karlsen @ 2003-07-23 0:19 UTC (permalink / raw)
To: netfilter
On Tue, 22 Jul 2003 20:08:58 +0400,
Xemul <epv_xemul@mail.ru> wrote in message
<20030722200858.74374455.epv_xemul@mail.ru>:
> Hi.
> I wanna solve such a problem:
> When I see that byte counter on some chain reaches or exceedes any
> fixed value - then IMMEDIATELY insert into that cahin new first rule
> (e.g. -j DROP) or delete some rules from any other chain. Or more
> abstract - how can can discover that byte counter is higher than smth
> without"polling" chains?
>
> Sorry for sending such a mail into announce, developers and user
> maillists but I need help as soon as possible. :)
>
..2 ways: either trottle using, say cbq, check the Advanced Routing
how-to, or get ip-limit from patch-o-matic.
..for cbq throttling for say 802.11 isp networks, feel free to try out
my wee http://fmb.no/ipcop/setup-cbq-0.0.4.tar.bz2, it could use a gui,
but is overkill a home user.
--
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
Scenarios always come in sets of three:
best case, worst case, and just in case.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Traffic limitation with iptables
2003-07-22 22:07 Traffic limitation with iptables George Vieira
2003-07-22 22:16 ` Esteban Ribicic
@ 2003-07-23 15:17 ` Xemul
1 sibling, 0 replies; 6+ messages in thread
From: Xemul @ 2003-07-23 15:17 UTC (permalink / raw)
To: netfilter
On Wed, 23 Jul 2003 08:07:40 +1000
"George Vieira" <georgev@citadelcomputer.com.au> wrote:
> Use the Quota patch and it'll limit the rule by itself..
>
Thank you VERY much :)
This is exactly what I want.
Well I've got one more question.
Consider using 2 additional tables like this:
iptables -N table1
iptables -N table2
iptbales -A FORWARD -s 192.168.2.1 -j table1
iptables -A FORWARD -s 192.168.2.2 -j table2
iptables -A table1 -m quota --quota 10000 -j RETURN
iptables -A table1 -j DROP
iptables -A table2 -m quota --quota 10000 -j RETURN
iptables -A table2 -j DROP
By doing this I'll limit outgoing traffic for 192.168.2.1 and for .2
independently and the speed won't be too small I hope.
Then consider I have not 2 but 100 tables like table1, table2, ...
table100. What about the perfomance in this case? Won't it be too small?
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-07-23 15:17 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-07-22 22:07 Traffic limitation with iptables George Vieira
2003-07-22 22:16 ` Esteban Ribicic
2003-07-23 15:17 ` Xemul
-- strict thread matches above, loose matches on Subject: below --
2003-07-22 23:17 George Vieira
2003-07-22 16:08 Xemul
2003-07-23 0:19 ` Arnt Karlsen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox