On Sun, 2006-04-09 at 14:00 +0100, Andy Furniss wrote: > Erik Slagter wrote: > > Hi, > > > > I am trying to do some simple ingress limiting based on fwmark. I know > > the ability and sense to do INGRESS limiting is ehm... limited ;-) but > > still I want to try it. > > > > I tried several things. > > > > === 1 === > > > > tcq ingress handle ffff: > > tcf parent ffff: protocol ip prio 1 handle 1 fw police rate 12mbit burst 10k drop > > tcf parent ffff: protocol ip prio 1 handle 2 fw police rate 10mbit burst 10k drop > > tcf parent ffff: protocol ip prio 1 handle 3 fw police rate 1mbit burst 10k drop > > > > This installs OK, but the filters are never called. The netfilter stats > > show the marks are set though. To make sure it's not just the tc stats > > output that's borked, I changed the bw limits to a rediculous low value, > > and indeed, no effect at all. > > > There are two policers now the old one will work as you want but you > need to change your kernel config. Unselect packet action and you should > be able to choose a different policer. Found it and deselected it. Now making new kernel... The "old" policer is marked as "obsolete", so I guess it will go away. What am I supposed to replace it with, then? > Or you could try using tc filters instead of netfilter - I don't know if > it will be possible for what you want as I can't see the rules that mark. It's probably possible, but I already have quite a large set of netfilter rules. I don't want to make the whole thing even more complicated by also adding lots of tc stuff, I'd rather have the tc/iproute things as simple as possible. > This has never worked if you want a queue on ingress you need to use IMQ > (in the case that you need netfilter PREROUTING marks) or IFB (kernel >= > 2.6.16) but this will hook before netfilter - so no marks. For IMQ I need to patch the kernel (feasible) and the netfilter tools (not feasible :-() I just learned. And you're just telling me I cannot use IFB. Bummer. Anyway, if there is any simple (!) way to implement what I am searching for, I am happy. I will try your "old policer version" suggestion asap. Thanks for your help.
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
