Re: IPTables script

Linux Advanced Routing and Traffic Control

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Sylvain,

Thanks for that, exactly what I'm doing :)

Along my travels I ran into this: http://l7-filter.sourceforge.net/
Have you played with L7 and can you rate it good/bad ?

The script you sent didn't answer one question, how to match on IP so I can 
add a further level of htb to equally share bandwidth amongst computers.

I think I know how to do this though, filter by MAC. I don't know if iptables 
at this point has munted the mac so I'm going to try that in a sec and see if 
I can get a match.

Alex: from what I read you can do more with netfilter than you can with tc 
filter. Depending on your needs you would use the simplest one as I believe 
tc filter to be easier to understand. L7 above also uses netfilter so there's 
possibly another reason.

:L

> > #!/bin/bash
> >
> > UPLINK_EXT=950          # outgoing DSL bandwidth, kbps
> > DEV_EXT=eth1            # DSL link
> >
> > tc qdisc del dev ${DEV_EXT} root    2> /dev/null > /dev/null
> >
> > tc qdisc add dev ${DEV_EXT} root handle 1: htb default 20
> >
> > # root class
> > tc class add dev ${DEV_EXT} parent 1: classid 1:1 htb rate
> > $[${UPLINK_EXT}]kbit prio 0
> > # fast ( 80% )
> > tc class add dev ${DEV_EXT} parent 1:1 classid 1:10 htb rate
> > $[8*${UPLINK_EXT}/10]kbit ceil $[${UPLINK_EXT}]kbit burst 10k prio 1
> > # slow ( 20% )
> > tc class add dev ${DEV_EXT} parent 1:1 classid 1:20 htb rate
> > $[2*${UPLINK_EXT}/10]kbit ceil $[8*${UPLINK_EXT}/10]kbit burst 2k prio 5
> >
> > # stochastic fairness
> > tc qdisc add dev ${DEV_EXT} parent 1:10 handle 10: sfq perturb 10
> > tc qdisc add dev ${DEV_EXT} parent 1:20 handle 20: sfq perturb 10
> >
> > # trafic with priority
> > # CLIENT
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 22 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 25 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 53 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 80 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 110 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 143 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 443 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 993 0xffff flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 995 0xffff flowid 1:10
> > # SERVER
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > sport 22 0xfffd flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > sport 25 0xfffd flowid 1:10
> > tc filter add dev ${DEV_EXT} protocol ip parent 1: prio 4 u32 match ip
> > dport 53 0xffff flowid 1:10
> >
> >
> > _______________________________________________
> > LARTC mailing list
> > LARTC@xxxxxxxxxxxxxxx
> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

-- 
_____________________________________________________
Lee Sanders                                                          Computer
Systems Engineer                                              Consultant
Email: tagline@xxxxxxxxxx                            Professionals
Mobile: 0400481632                                    77 122 550 929
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

[Index of Archives]     [LARTC Home Page]     [Netfilter]     [Netfilter Development]     [Network Development]     [Bugtraq]     [GCC Help]     [Yosemite News]     [Linux Kernel]     [Fedora Users]
  Powered by Linux