The only (common) time you need to use iptables to mark traffic, is when you're using egress qdiscs on your outbound (WAN) interface (to shape upload speeds) and want to filter based on private (LAN) IP address.For some reason that hadn't occurred to me. That should work just fine. I guess I should mark the packets in iptables to avoid throttling traffic from gateway itself, or does match see the external ip?
because you can't shape inbound traffic. Shaping works by delaying the transmission, andIMQ does seem like a handy tool, but why is there a distinction at all between egress and ingress qdiscs at all? Why not just allow people to attach HTB as an ingress qdisc directly?
you can't delay packets that haven't arrived yet. Ingress policing just drops packets, and hopes the sender will slow down.
That's an interesting idea, but yeah... i think it might be a bit hard to implement, and violate far too many RFCs...I suppose in an ideal world the best thing would be to receive the packets, hand them to user-space, but not mark them as received, ie, not ack them. That avoids introducing any loss from the user point of view but still slows the flow down. But that seems fiddly and would only work for TCP I guess.
regards,
-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Damion de Soto - Software Engineer email: damion@xxxxxxxxxxxx SnapGear - A CyberGuard Company --- ph: +61 7 3435 2809 | Custom Embedded Solutions fax: +61 7 3891 3630 | and Security Appliances web: http://www.snapgear.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- Free Embedded Linux Distro at http://www.snapgear.org --- _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
