On Thu, 26 May 2005 19:56:09 +0100 Andy Furniss <andy.furniss@xxxxxxxxxxxxx> wrote:
Peter Kaagman wrote:
But there is of course a src of packages I do not catch this way... and these are the squid cache hits. Because I filter on destination the cache hits get treated the same as cache misses. But cache hits are in effect local traffic... they do not originate from the Internet.
If squid is running on the same machine as your htb rules then (I think) the only way you can shape incoming traffic from the internet properly is to use imq.
I think IMQ needed only if there are not one interface to shape.
I have not used squid - so may be wrong, but the patches will let you classify hits so they can be let through at lan speed. But what about misses - I assume that squid will connect to the internet and fetch the data unlimited even if they then get served to the lan at restricted speed.
Inet <-----(one for all src)NAT<--(MISSES)---(src 192.168.90.0/28 dst 'real Inet IP')Squid<---(HITS+MISSES)---hosts
Inet ----->(one for all dst)NAT--(MISSES)--->(dst 192.168.90.0/28 src 'real Inet IP')Squid---(HITS+MISSES)--->hosts
The last not fully right... But clenly illustrates the idea.
You can simply shape the MISSES on one interface...
Well remember I don't use squid so don't really know, but I imagine that all lan connections on the relevant ports go to squid and squid then makes seperate connections to the internet if required. So all traffic headed from the internet to squid will have the dst IP of the internet interface even if you hook imq after (de)NAT other traffic will have local dst addresses.
Andy.
_______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
