> > Please describe your network topology. > Sure, it's a basic masq setup with 1 external (WAN) and 2 internal (LAN) interfaces |------------------------------------------| | <-> eth1/192.168.241.1 | <-> 192.168.241.0 LAN Internet <-> | eth0/12.10.109.52 | | <-> eth2/192.168.242.1 | <-> 192.168.242.0 LAN |------------------------------------------| Gateway Computer w/ 2 NICs I want to limit the upstream (to the internet) of both eth1 and eth2 to 128kbps. I want to limit the downstream (from the internet) of eth1 to 128kbps and 256kbps on eth2. I can limit the upstream of both interfaces with this: tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 10Mbit avpkt 1000 cell 8 tc class add dev eth0 parent 1:0 classid 1:1 cbq bandwidth 10Mbit rate \ 10Mbit weight 1Mbit prio 8 allot 1514 cell 8 maxburst 100 avpkt 1000 tc class add dev eth0 parent 1:1 classid 1:10 cbq bandwidth 10Mbit rate \ 128Kbit weight 12Kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded tc qdisc add dev eth0 parent 1:10 tbf rate 128Kbit buffer 10Kb/8 limit 15Kb mtu 1500 tc filter add dev eth0 parent 1:0 protocol ip prio 100 handle 1 fw classid 1:10 I can limit the downstream with this: tc qdisc add dev eth0 handle ffff:0 ingress tc filter add dev eth0 parent ffff:0 protocol ip prio 5 handle 1 fw \ police rate 128kbit burst 128kbit mtu 1500 drop What I think I need is a separate filter for eth1 and eth2 that looks for different marks (handles?) Therefore, I need to mark packets coming through eth0 to eth1 with a 0x1 and from eth0 to eth2 with a 0x2 and filter accordingly (I think). > > Hi Folks, > > > > I'm using a 2.4.x kernel and TC from the iproute2 package > > so that I can limit traffic through my gateway. I'm using this > > to mark packets when they leave the LAN: > > > > /sbin/ipchains -A forward -j MASQ -i eth0 -s 192.168.1.0/24 -d 0.0.0.0/0 > > -m 1 > > > > When the packets return, I need to have them marked again so that > > the ingress filter will limit the bandwidth in the opposite direction. > > > > The only way I have found to do this, is to mark EVERY packet like this: > > > > /sbin/ipchains -A input -i eth0 -s 0.0.0.0/0 -d 12.10.109.52/32 -m 1 > > > > This works, but what I would really like to do, is mark the > > 192.168.1.0/24 packets instead (after they have been "un-masq'ed", > > so that I can limit bandwidth on each interface in the gateway box. > > > > Is this possible? > > > > Thanks, > > > > Barton > > > > _______________________________________________ > > LARTC mailing list / LARTC@xxxxxxxxxxxxxxx > > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: > http://ds9a.nl/2.4Routing/ > >