Andy Furniss wrote:
If clientip is local because you are NATing than it won't work because
traffic will have the real ip here.
To work around you could use marks. As you already use them for some
things you may want to use --or-mark and u32 to match them eg.
iptables -A POSTROUTING -t mangle -p icmp -j MARK --set-mark 0x0100
and so on for traffic types using high byte then use low byte and
--or-mark for addresses
iptables -A POSTROUTING -t mangle -s 192.168.0.1 -j MARK --or-mark 0x0001
Then filter top level with a mask like
tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match mark
0x0100 0xff00 flowid 1:20
and leaf levels
tc filter add dev eth0 parent 1:20 protocol ip prio 1 u32 match mark
0x0001 0x00ff flowid 1:200
That assumes you really need iptables for marking traffic type - if you
could use tc filters for that, then just use iptables for the addresses.
Something I've only just noticed from a comment in the code - htb can
use mark without the need for lots of filters.
You only need one empty filter on the root (maybe you can still nest) like -
tc filter add dev eth0 parent 1:0 protocol ip prio 1 fw
and then if you arrange for your classes to be the same minor numbers as
the marks it will behave like using classify.
You need to set the major number of your htb (1 in example above) in the
top 16 bits of the mark.
There is also a netfilter pom-ng patch IPMARK that will set marks based
on ipaddress.
Andy.
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
