On Tue, 20 Feb 2001, Spyou wrote: > i'm trying to shape incoming trafic on my linux box. I think putting the following on your system is a must: http://defiant.coinet.com/iproute2/equinox/cbq_init.html > I want it to depend on the source IP adress of the packets (in fact, i got > a VPN on an ADSL link and wanted to get at least/max 64Kbit/s for the VPN) > > So i tried this : [all those commands that would make iproute newbies like hitting a thick wall at 100mph; and after two weeks, the wall is as thick as before; deleted] > Okay, so, with this, packets comming trought ppp0 and from <the SRC IP of > my VPN> should be shaped at 64Kbit/s, right ? It is explained that iproute limits outgoing bandwidth only ("outgoing" if seen _from_ your net devices). Recently, I tried something that seems to be working; my setup: 128Kbit 100Mbit [Internet]-------[eth1]-------[eth0] 192.168.1.x Squid I wanted to limit web access to about 40Kbit. The entry file for cbq.init: DEVICE=eth0,100Mbit,10Mbit RATE=40Kbit WEIGHT=4Kbit PRIO=7 RULE=:80,192.168.1.x BOUNDED=no ISOLATED=yes Meaning: the device used is eth0, at 100Mbit. Transfer rate is at 40Kbit. The traffic from port 80, from any addresses that go to 192.168.1.x, will use 40Kbit, at least. It is unbounded, so if the line still permits (128Kbit), the traffic from port 80 would borrow the remaining bandwidth. But the limiter has priority of 7, which will release the borrowed bandwidth to any higher (1-6) priority limiters. I thought that this setting wouldn't work. But it seems that iproute limits the traffic "from eth0 to 192.168.1.x"; which, in a sense, is "outgoing". I monitor the traffic using MRTG, the graphs are fine. And also, cbg.init has "stats" command so you can see which unbounded limiters that borrow bandwidth from the others. > Where's my error ? For not using cbq.init...? >Is there something more simple (eg. with iptables and > packet marking ?) You can use iptables along with cbq.init (no, cbq.init doesn't support packet marking yet); all you need is to name the entry-files correctly (the names become the classid of the limiters), and then execute iptables for packet filtering after cbq.init (use the flowid's accordingly; according to the entry-file names). Oki ps: the above cbq.init's config would have problem if the machine accessed other internal machines at port 80; so the web traffic would be limited also. But for the problem that was at hand, is no problem. -- So much free software So little time...
