This is a multi-part message in MIME format.
------=_NextPart_000_0124_01C3DAB8.7BF72D20
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,=20
I been trying on ip rule fwmark and iptables MARK.=20
I will show my testing in detail, but my ultimate question is why ONLY =
marking in Mangle OUTPUT tables works, but not others?
Network Diagram
------------ 192.168.250.197 eth0 LINUX ROUTER eth1 192.168.8.88 =
------------------ 192.168.8.112 eth0 Windows XP Client
Steps (performed on LINUX ROUTER)
(1) Delete route to 192.168.8.0 from local routing table on
(2) Add route to 192.168.8.0 at table test2
(3) Mark packet with --set-mark 3 at MANGLE OUTPUT table
(4) Forward all packet marked 3 to table test2 using ip rule fwmark
(5) Do a ip ro flush cache
(6) Ping from 192.168.8.112 to 192.168.8.88 is successful
[root@son-ag webauth]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use =
Iface
192.168.250.0 0.0.0.0 255.255.255.0 U 0 0 0 =
eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 =
lo
0.0.0.0 192.168.250.254 0.0.0.0 UG 0 0 0 =
eth0
[root@son-ag webauth]# ip route show table test2
192.168.8.0/24 via 192.168.8.88 dev br0
[root@son-ag webauth]# iptables -t mangle -L
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
MARK all -- anywhere anywhere MARK set 0x3
[root@son-ag webauth]# ip ru
0: from all lookup local
32764: from all fwmark 3 lookup test2
32766: from all lookup main
32767: from all lookup 253
I wish to know why is that ONLY marking at OUTPUT table works?
The network setup is for testing purpose, I wish to know the precedence =
of iptables chains, local routing table and newly created table (e.g. =
test2)
Looking at the iptables chain diagram, my guess is MARKING at mangle =
INPUT or mangle PREROUTING should work as well.=20
When packet comes off from wire, I mark it with 3 at mangle PREROUTING. =
Since it is a ping to 192.168.8.88, it should be a local process.
Then the ping is successful. But from my testing, no.=20
Another possiblity is packet is route to test2 routing table after =
mangle OUTPUT and before mandle POSTROUTING. I am getting confuse :)
Please advice. Thank you
Kaiwen
------=_NextPart_000_0124_01C3DAB8.7BF72D20
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I been trying on ip rule fwmark and =
iptables MARK.=20
I will show my testing in detail, but =
my ultimate=20
question is why ONLY marking in Mangle OUTPUT tables works, but not=20
others?
Network Diagram
------------ 192.168.250.197 eth0 LINUX =
ROUTER eth1=20
192.168.8.88 ------------------ 192.168.8.112 eth0 Windows XP=20
Client
Steps (performed on LINUX =
ROUTER)
(1) Delete route to 192.168.8.0 from =
local routing=20
table on
(2) Add route to 192.168.8.0 at table=20
test2
(3) Mark packet with --set-mark 3 at =
MANGLE OUTPUT=20
table
(4) Forward all packet marked 3 to =
table test2=20
using ip rule fwmark
(5) Do a ip ro flush cache
(6) Ping from 192.168.8.112 to =
192.168.8.88 is=20
successful
[root@son-ag webauth]# route =
-n
Kernel IP=20
routing table
Destination =20
Gateway =20
Genmask Flags Metric=20
Ref Use Iface
192.168.250.0 =20
0.0.0.0 =20
255.255.255.0 U =20
0 =
0 0=20
eth0
127.0.0.0 =20
0.0.0.0 =20
255.0.0.0 U =20
0 =
0 0=20
lo
0.0.0.0 =
192.168.250.254=20
0.0.0.0 =
UG =20
0 =
0 0=20
eth0
[root@son-ag webauth]# ip route show =
table=20
test2
192.168.8.0/24 via 192.168.8.88 dev br0
[root@son-ag webauth]# iptables -t =
mangle=20
-L
Chain OUTPUT (policy=20
ACCEPT)
target prot opt=20
source &=
nbsp; =20
destination
MARK all =
-- =20
anywhere =
; =20
anywhere =
MARK set=20
0x3
[root@son-ag webauth]# ip=20
ru
0: from all lookup =
local
32764: =20
from all fwmark 3 lookup=20
test2
32766: from all lookup main
32767: from all =
lookup=20
253
I wish to know why is that ONLY marking =
at OUTPUT=20
table works?
The network setup is for testing =
purpose, I wish to=20
know the precedence of iptables chains, local routing table and =
newly=20
created table (e.g. test2)
Looking at the iptables chain diagram, =
my guess is=20
MARKING at mangle INPUT or mangle PREROUTING should work as well. =
When packet comes off from wire, I mark =
it with 3=20
at mangle PREROUTING. Since it is a ping to 192.168.8.88, it should be a =
local=20
process.
Then the ping is successful. But from =
my testing,=20
no.
Another possiblity is packet is route =
to test2=20
routing table after mangle OUTPUT and before mandle POSTROUTING. I am =
getting=20
confuse :)
Please advice. Thank you
Kaiwen
------=_NextPart_000_0124_01C3DAB8.7BF72D20--
From eddieknows@ananzi.co.za Wed Jan 14 09:22:14 2004
From: eddieknows@ananzi.co.za (Eddie)
Date: Wed, 14 Jan 2004 11:22:14 +0200
Subject: [LARTC] htb+redhat7.3
Message-ID: <1074072134.2557.8.camel@testbox.co.za>
HI all
Just doing so recon before doing a installation
Will htb work on redhat 7.3,default kernel,i think 2.4.18?
Thanks
From mind@bi.lt Wed Jan 14 09:14:10 2004
From: mind@bi.lt (Mindaugas Riauba)
Date: Wed, 14 Jan 2004 11:14:10 +0200
Subject: [LARTC] Problems while mixing protocols
Message-ID: <008f01c3da7e$c84a41b0$f20214ac@bite.lt>
Hello,
I'm trying to shape traffic by IP addresses and by 802.1q vlans.
But when I add 802.1q filter filters output looks strange.
Maybe I'm missing some options to TC?
Thanks,
Mindaugas
# ./bin/tc -s -d filter show dev eth0
filter parent 1: protocol ip pref 1 u32
filter parent 1: protocol ip pref 1 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 1 u32 fh 800::800 order 2048 key ht 800
bkt 0 flowid 1:10
match d5e2b800/fffffe00 at 12
filter parent 1: protocol ip pref 1 u32 fh 800::801 order 2049 key ht 800
bkt 0 flowid 1:11
match d5e28af0/fffffff8 at 12
filter parent 1: protocol ip pref 1 u32 fh 800::802 order 2050 key ht 800
bkt 0 flowid 1:11
match d5e28af8/fffffffc at 12
filter parent 1: protocol ip pref 1 u32 fh 800::803 order 2051 key ht 800
bkt 0 flowid 1:200
match d5e2a020/fffffffc at 12
filter parent 1: protocol ip pref 1 u32 fh 800::804 order 2052 key ht 800
bkt 0 flowid 1:300
match d5e2a024/fffffffc at 12
# ./bin/tc filter add dev eth0 parent 1: protocol 802.1Q u32 match u16 5
0x0fff flowid 1:500
# ./bin/tc -s -d filter show dev eth0
filter parent 1: protocol ip pref 1 u32
filter parent 1: protocol ip pref 1 u32 fh 801: ht divisor 1
filter parent 1: protocol ip pref 1 u32 fh 801::800 order 2048 key ht 801
bkt 0 flowid 1:500
match 00050000/0fff0000 at 0
filter parent 1: protocol ip pref 1 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 1 u32 fh 800::800 order 2048 key ht 800
bkt 0 flowid 1:10
match d5e2b800/fffffe00 at 12
filter parent 1: protocol ip pref 1 u32 fh 800::801 order 2049 key ht 800
bkt 0 flowid 1:11
match d5e28af0/fffffff8 at 12
filter parent 1: protocol ip pref 1 u32 fh 800::802 order 2050 key ht 800
bkt 0 flowid 1:11
match d5e28af8/fffffffc at 12
filter parent 1: protocol ip pref 1 u32 fh 800::803 order 2051 key ht 800
bkt 0 flowid 1:200
match d5e2a020/fffffffc at 12
filter parent 1: protocol ip pref 1 u32 fh 800::804 order 2052 key ht 800
bkt 0 flowid 1:300
match d5e2a024/fffffffc at 12
filter parent 1: protocol 802.1Q pref 49152 u32
filter parent 1: protocol 802.1Q pref 49152 u32 fh 801: ht divisor 1
filter parent 1: protocol 802.1Q pref 49152 u32 fh 801::800 order 2048 key
ht 801 bkt 0 flowid 1:500
match 00050000/0fff0000 at 0
filter parent 1: protocol 802.1Q pref 49152 u32 fh 800: ht divisor 1
filter parent 1: protocol 802.1Q pref 49152 u32 fh 800::800 order 2048 key
ht 800 bkt 0 flowid 1:10
match d5e2b800/fffffe00 at 12
filter parent 1: protocol 802.1Q pref 49152 u32 fh 800::801 order 2049 key
ht 800 bkt 0 flowid 1:11
match d5e28af0/fffffff8 at 12
filter parent 1: protocol 802.1Q pref 49152 u32 fh 800::802 order 2050 key
ht 800 bkt 0 flowid 1:11
match d5e28af8/fffffffc at 12
filter parent 1: protocol 802.1Q pref 49152 u32 fh 800::803 order 2051 key
ht 800 bkt 0 flowid 1:200
match d5e2a020/fffffffc at 12
filter parent 1: protocol 802.1Q pref 49152 u32 fh 800::804 order 2052 key
ht 800 bkt 0 flowid 1:300
match d5e2a024/fffffffc at 12
From rabs@dimension-virtual.com Wed Jan 14 09:35:01 2004
From: rabs@dimension-virtual.com (=?iso-8859-1?q?Ra=FAl_Alexis_Betancort_Santana?=)
Date: Wed, 14 Jan 2004 09:35:01 +0000
Subject: [LARTC] Bandwith Aggregation
In-Reply-To: <681354627.20040113203631@ire.pw.edu.pl>
References: <0HRF00D4WZ6FBV@campus.uab.es> <681354627.20040113203631@ire.pw.edu.pl>
Message-ID: <200401140935.01080.rabs@dimension-virtual.com>
El Martes, 13 de Enero de 2004 19:36, Robert Kurjata escribi=F3:
> For the start read my posting from 15th Oct 03 as an working example.
I have just a question about your script (I found it on the archives)...
I have 3 DSL lines, linke you, but all of them are conected to a switch and=
=20
then to my eth1 interface on wich I have 3 public ip's and 2 public ip's=20
ranges, let me try to draw it.
DMZ Zone
|
eth3
DSL1\ |
DSL2 - - Switch - eth1 [Linux Box] - eth0 -Switch - LAN
DSL3 / |
eth2
|
LDMS
What I need is to send all SMTP/POP3 traffic throught DSL1, and the rest of=
=20
traffict througth a load balancing between DSL2 and DSL3 giving preference=
=20
on DSL3 over DSL2 (moreover because DSL3 it's a 2Mbits simetric line with t=
he=20
local cable company, and DSL2 it's a ADSL 256Kbit), but if DSL1 fails, the=
=20
SMTP/POP3 traffic should go out by any of the other interfaces, also if DSL=
2=20
or DLS3 get out, rest of traffic should go by DSL1.
=20
The LDMS link its used only for IPSec tunnels and should never be user for=
=20
nomal traffic.
DSL1 -> ADSL 256 with a /30 public range on the ethernet side.
DSL2 -> ADSL 256 in bridge mode, so I have it's public IP on my side.
DSL3 -> Cable 2Mbit with a /30 public range on the ethernet side.
By now I only have setup a simple link with it's gateway using DSL1 for all=
=20
traffic, and I'm been unable to do that if a ssh conection (for example)=20
reach eth1 by DSL3 or reach eth2 by LDMS and get answered by the same link.
May someone give me a hit on what I'm doing wrong or what must I do to get =
it=20
working.
Best regards
From rabs@dimension-virtual.com Wed Jan 14 09:47:44 2004
From: rabs@dimension-virtual.com (=?iso-8859-1?q?Ra=FAl_Alexis_Betancort_Santana?=)
Date: Wed, 14 Jan 2004 09:47:44 +0000
Subject: [LARTC] Bandwith Aggregation
In-Reply-To: <200401140935.01080.rabs@dimension-virtual.com>
References: <0HRF00D4WZ6FBV@campus.uab.es> <681354627.20040113203631@ire.pw.edu.pl> <200401140935.01080.rabs@dimension-virtual.com>
Message-ID: <200401140947.44620.rabs@dimension-virtual.com>
I forgot to mention that I'm running Debian Sid, with kernel 2.6.1 patched
with NANO patchs and iproute2 with HTB support (but by now I'm not interested
on clasiffiying traffic, that will be later)
From andy.furniss@dsl.pipex.com Wed Jan 14 09:21:41 2004
From: andy.furniss@dsl.pipex.com (Andy Furniss)
Date: Wed, 14 Jan 2004 09:21:41 +0000
Subject: [LARTC] Bridge + leased line + tc
In-Reply-To:
References:
Message-ID: <04011409214100.00678@amd>
On Tuesday 13 January 2004 4:15 pm, Wouter Coppens wrote:
> Hi,
>
> I can't get traffic shaping working.
>
> This is my situation:
>
>
> -------- ------
> Net1 ----- |router| -------------------- | TC | ----------- Net2
> -------- leased line ------
>
> eth1 eth0
>
> We use the leased line for normal traffic but also for synchronisation
> between 2 servers. The leased line is 2mbit. The synchronisation
> generates too much traffic and uses completely the 2mbit capacity of the
> leased line. This is no problem during night, but we want to limit the
> synchronisation traffic during day (or in other words: the sync-traffic
> should get the lowest priority and the other traffic can use up to
> 2mbit).
>
> According to the documentation, you can only shape outgoing traffic. We
> took a PC (named TC) and put the network interfaces in bridge mode.
> The synchronisation happens from Net1 to Net2, so TC is after the leased
> line.
> Normally you would shape the outgoing traffic on eth0, but this doesn't
> work. We even tried to limit eth0 to 20kbit, but the synch-traffic
> completely fills the leased line and no other traffic gets through.
>
> We found a temporary fix by using IMQ with iptables:
> /sbin/tc qdisc del root dev imq0
> /sbin/tc qdisc add dev imq0 root handle 1: htb default 20
> /sbin/tc class add dev imq0 parent 1: classid 1:1 htb rate 2Mbit burst
> 6k
> /sbin/tc class add dev imq0 parent 1:1 classid 1:10 htb rate 64kbit ceil
> 787kbit
> /sbin/tc class add dev imq0 parent 1:1 classid 1:20 htb rate 2Mbit
> /sbin/tc qdisc add dev imq0 parent 1:10 handle 10: sfq perturb 10
> /sbin/tc qdisc add dev imq0 parent 1:20 handle 20: sfq perturb 10
> /sbin/tc filter add dev imq0 parent 1: protocol ip prio 18 u32 match ip
> dst 10.10.10.10 flowid 1:10 (10.10.10.10 is ip of server in Net2).
>
>
> Is there a better way to give the sync-traffic the lowest priority? If
> somybody starts a download it should get 2mbit and the sync-traffichttp
> should get the rest (if any).
>
> We would like to upgrade to 2.6, but imq is not maintained. Any help?
IMQ has been ported to 2.6 http://www.digriz.org.uk/jdg-qos-script/
Andy.
From Robert Kurjata Wed Jan 14 10:46:31 2004
From: Robert Kurjata (Robert Kurjata)
Date: Wed, 14 Jan 2004 11:46:31 +0100
Subject: [LARTC] public subnet routing
In-Reply-To: <1074058673.1174.11.camel@boxen.charter.net>
References: <1074058673.1174.11.camel@boxen.charter.net>
Message-ID: <1381903767.20040114114631@ire.pw.edu.pl>
Witaj PSC,
W Twoim liœcie datowanym 14 stycznia 2004 (06:37:53) mo¿na przeczytaæ:
P> Just wondering if someone could answer this question for me.
P> I would like to route public addresses only. Their will be no firewall
P> but maybe a few rules to deny certain types of traffic. Here is the
P> configuration of the router.
P> My provider gave a me a /30 link to their router
P> also they gave me a /25 network for my customers public ip's
P> Their cisco router has static route entrys for my public subnet
P> The router has been configured as follows
P> eth0 has been configured with :
P> 205.95.67.102/30
P> eth1 is configured as
P> 209.95.45.1/25 and is the gateway for my customers.
just set properly your router default route :)
(guessing the gateway ip :)
ip ro add default via 205.95.67.103 dev eth0
and should work :) (works for me :)
P> Beside ip_forwarding being enabled is their anything that I need to do
P> so my customers can access the ouside and the public to access their
P> ip's.
P> Thanks in advance for the help
P> _______________________________________________
P> LARTC mailing list / LARTC@mailman.ds9a.nl
P> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
--
Pozdrowienia,
Robert mailto:rkurjata@ire.pw.edu.pl
From cord@keppler.vrg.de Wed Jan 14 11:47:22 2004
From: cord@keppler.vrg.de (Cord Buhlert)
Date: Wed, 14 Jan 2004 12:47:22 +0100
Subject: [LARTC] imq-patch for 2.4.24 kernel
Message-ID: <20040114114722.GA15636@keppler.vrg.de>
Hi,
is there an IMQ-patch available for kernel version 2.4.24?
If so, where can I get it?
greetz
cord
From cord@keppler.vrg.de Wed Jan 14 14:17:31 2004
From: cord@keppler.vrg.de (Cord Buhlert)
Date: Wed, 14 Jan 2004 15:17:31 +0100
Subject: [LARTC] question about major:minor numbers
Message-ID: <20040114141731.GA15980@keppler.vrg.de>
Hi,
the documentation says "[the major number of a class] must be unique
within a egress or ingress setup. The minor number must be unique within
a qdisc and his classes."
What is meant by "setup"? Does that include all qdiscs attached to any
network device? Ie, if I have a qdisc attached to eth0 and another
attached to eth1, do the major numbers I use have to be different at all
or could I use the same number structure in eth0 and eth1?
Short example to explain:
tc qdisc add dev eth0 root handle 1: htb default 13
tc class add dev eth0 parent 1: classid 1:1 htb rate 100kbps...
tc class add dev eth0 parent 1:1 classid 1:10 htb rate...
...
tc qdisc add dev eth1 root handle 1: htb default 13
tc class add dev eth1 parent 1: classid 1:1 htb rate 100kbps...
tc class add dev eth1 parent 1:1 classid 1:10 htb rate...
...
Is this valid? Or do I have to use "2:" instead of "1:" in the second
part?
thanx
cb
From andre.correa@pobox.com Wed Jan 14 12:30:09 2004
From: andre.correa@pobox.com (Andre Correa)
Date: Wed, 14 Jan 2004 10:30:09 -0200
Subject: [LARTC] question about major:minor numbers
In-Reply-To: <20040114141731.GA15980@keppler.vrg.de>
References: <20040114141731.GA15980@keppler.vrg.de>
Message-ID: <40053651.9040100@pobox.com>
Cord, you can use the same major numbers in diferent devices, no
problem. You cannot have repeated minor numbers in the same device, but
in diferent devices it is OK.
Note that sometimes using diferent major numbers may be a good idea, for
example, when you are scripting this may help...
Andre
Cord Buhlert wrote:
> Hi,
> the documentation says "[the major number of a class] must be unique
> within a egress or ingress setup. The minor number must be unique within
> a qdisc and his classes."
>
> What is meant by "setup"? Does that include all qdiscs attached to any
> network device? Ie, if I have a qdisc attached to eth0 and another
> attached to eth1, do the major numbers I use have to be different at all
> or could I use the same number structure in eth0 and eth1?
>
> Short example to explain:
> tc qdisc add dev eth0 root handle 1: htb default 13
> tc class add dev eth0 parent 1: classid 1:1 htb rate 100kbps...
> tc class add dev eth0 parent 1:1 classid 1:10 htb rate...
> ...
>
> tc qdisc add dev eth1 root handle 1: htb default 13
> tc class add dev eth1 parent 1: classid 1:1 htb rate 100kbps...
> tc class add dev eth1 parent 1:1 classid 1:10 htb rate...
> ...
>
> Is this valid? Or do I have to use "2:" instead of "1:" in the second
> part?
>
> thanx
> cb
>
>
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
>
From andre.correa@pobox.com Wed Jan 14 11:48:36 2004
From: andre.correa@pobox.com (Andre Correa)
Date: Wed, 14 Jan 2004 09:48:36 -0200
Subject: [LARTC] ingress policing
In-Reply-To:
References:
Message-ID: <40052C94.3060106@pobox.com>
Hi Vinh, I've noticed the same thing some months ago and couldn't figure
out why. The workarround for this is to use half speed in your
"upload" classes... It seens that it just happens to outgoing traffic
(ingress or not).
Maybe somone else can explian it... I just figured out the same problem...
Andre
Vinh Nguyen wrote:
> Hi,
>
> I'm trying to police the incoming traffic by using ingress qdisc,this is what I have in my script
>
> tc qdisc add dev eth0 handle ffff: ingress
>
> tc filter add dev eth0 parent ffff: protocol ip prio 4 \
> handle 1: u32 divisor 1
>
> tc filter add dev eth0 parent ffff: protocol ip prio 4 u32 \
> match ip dport 4001 0xffff \
> police rate 2000kbit burst 50k drop \
> flowid 1:1
>
> I'm sending a 9Mb traffic using iperf but noticed that the bandwith at the receiving end is 4 MB instead of 2M. When Im changing the police rate to 3MB, the traffic at the receiving end is 6MB. Any ideas why does this happen? Your help is greatly appreciated.
>
> Vince
>
>
>
> UTS CRICOS Provider Code: 00099F
>
> DISCLAIMER
> ========================================================================
> This email message and any accompanying attachments may contain
> confidential information. If you are not the intended recipient, do not
> read, use, disseminate, distribute or copy this message or attachments.
> If you have received this message in error, please notify the sender
> immediately and delete this message. Any views expressed in this message
> are those of the individual sender, except where the sender expressly,
> and with authority, states them to be the views the University of
> Technology Sydney. Before opening any attachments, please check them for
> viruses and defects.
> ========================================================================
>
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
>
From ionut@topall.ro Fri Jan 9 23:14:59 2004
From: ionut@topall.ro (ionut@topall.ro)
Date: Fri, 9 Jan 2004 18:14:59 -0500 (EST)
Subject: [LARTC] brige conf
In-Reply-To: <20040108225602.26395.4607.Mailman@outpost.ds9a.nl>
References: <20040108225602.26395.4607.Mailman@outpost.ds9a.nl>
Message-ID: <4477.80.97.103.2.1073690099.squirrel@mail.topall.ro>
Hi i'm using a bridge for traffic control and now i have 300 user the
problem is there is a large script for tc for incomming and outgoing
traffic about 1300 lines. Evrithing is fine but it seams i lost 2ms on
bridge . I ping from my machine (linux gateway) to the my internet gateway
an ATI router, my conncetion is at 100Mbit from my machine to the ATI. Wen
i'm not using bridge evrything is fine i have 0.400ms.
I read something about HZ=100 but i don't understanding wath i need to do !
Any sugestio is wellcome!
Thx Guy's
From ricardo_soria@yahoo.com Wed Jan 14 17:50:33 2004
From: ricardo_soria@yahoo.com (=?iso-8859-1?q?Ricardo=20Soria?=)
Date: Wed, 14 Jan 2004 11:50:33 -0600 (CST)
Subject: [LARTC] htb+redhat7.3
Message-ID: <20040114175033.97148.qmail@web41501.mail.yahoo.com>
Hi there:
The original kernel included in RedHat 7.3 does *not*
include htb support. You have to patch that kernel if
you want to use htb. Visit
http://luxik.cdi.cz/~devik/qos/htb/ for further
instrucctions.
Good luck.
Ricardo Soria.
_________________________________________________________
Do You Yahoo!?
Información de Estados Unidos y América Latina, en Yahoo! Noticias.
Visítanos en http://noticias.espanol.yahoo.com
From mwitkowski@e-ar.pl Wed Jan 14 19:42:22 2004
From: mwitkowski@e-ar.pl (=?ISO-8859-2?Q?Micha=B3_Witkowski?=)
Date: Wed, 14 Jan 2004 20:42:22 +0100
Subject: [LARTC] wich tools
Message-ID: <40059B9E.80602@e-ar.pl>
Hello
I have two DSL modems witch are connected to my isp, in future my boss
want to buy another connection via DSL modem. Then i will have 3 DSL
modems. With every DSL modem i get 3x8 IP`s (netmask 248) from my ISP,
now i have question how to configure gateway wich tools should i use.
Because ip route and next hop via. wich i use now makes his work fine
but with new kernels there is an error in syslog "route sent us
somewhere else", and i think that with 3 DSL`s i will have problem
(there can be situation when 1DSL is busy and 2DSL aren`t).
Greetings
Michal Witkowski
From mstavrev@it-academy.bg Wed Jan 14 21:07:54 2004
From: mstavrev@it-academy.bg (Marin Stavrev)
Date: Wed, 14 Jan 2004 23:07:54 +0200 (EET)
Subject: [LARTC] Any NISTNet alternative or fix ?
Message-ID: <3195.212.104.98.70.1074114474.squirrel@oldmail.it-academy.bg>
Hi,
I need to simulate (with a certain degree of control) common WAN
problems like packet loss/duplication, delay and conditions of limited
bandwidth. I found that NISTNet is what i need, but it seems the package
has not been updated since October, 2000.
This is not really a problem as I found NISTNet runs perfectly with
Linux kernels up to 2.4.23 (officially 2.4.18 is the latest mentioned in
documentation).
What then am I complaining about ? Well, it seems that NISTNet is
intercepting IP packets before the conntrack can do its job in the
PREROUTING phase. So if you are doing SNAT or DNAT on the same machine
where NISTNet is running, you can not use the de-NATed IP addresses to
build rules.
I certainly can find solution to this problem by altering my test topology
and tweaking a little bit network configuration, but still the question
remains: Is there any fresh substitute for what NISTNet does ?
From Robert Kurjata Wed Jan 14 20:46:15 2004
From: Robert Kurjata (Robert Kurjata)
Date: Wed, 14 Jan 2004 21:46:15 +0100
Subject: Re[2]: [LARTC] Bandwith Aggregation
In-Reply-To: <200401140935.01080.rabs@dimension-virtual.com>
References: <0HRF00D4WZ6FBV@campus.uab.es>
<681354627.20040113203631@ire.pw.edu.pl>
<200401140935.01080.rabs@dimension-virtual.com>
Message-ID: <1317673654.20040114214615@ire.pw.edu.pl>
Witaj Raúl,
W Twoim liœcie datowanym 14 stycznia 2004 (10:35:01) mo¿na przeczytaæ:
RABS> El Martes, 13 de Enero de 2004 19:36, Robert Kurjata escribió:
>> For the start read my posting from 15th Oct 03 as an working example.
RABS> I have just a question about your script (I found it on the archives)...
RABS> I have 3 DSL lines, linke you, but all of them are conected to a switch and
RABS> then to my eth1 interface on wich I have 3 public ip's and 2 public ip's
RABS> ranges, let me try to draw it.
RABS> DMZ Zone
RABS> |
RABS> eth3
RABS> DSL1\ |
RABS> DSL2 - - Switch - eth1 [Linux Box] - eth0 -Switch - LAN
RABS> DSL3 / |
RABS> eth2
RABS> |
RABS> LDMS
RABS> What I need is to send all SMTP/POP3 traffic throught DSL1, and the rest of
RABS> traffict througth a load balancing between DSL2 and DSL3 giving preference
RABS> on DSL3 over DSL2 (moreover because DSL3 it's a 2Mbits simetric line with the
RABS> local cable company, and DSL2 it's a ADSL 256Kbit), but if DSL1 fails, the
RABS> SMTP/POP3 traffic should go out by any of the other interfaces, also if DSL2
RABS> or DLS3 get out, rest of traffic should go by DSL1.
RABS> The LDMS link its used only for IPSec tunnels and should never be user for
RABS> nomal traffic.
DSL1 ->> ADSL 256 with a /30 public range on the ethernet side.
DSL2 ->> ADSL 256 in bridge mode, so I have it's public IP on my side.
DSL3 ->> Cable 2Mbit with a /30 public range on the ethernet side.
RABS> By now I only have setup a simple link with it's gateway using DSL1 for all
RABS> traffic, and I'm been unable to do that if a ssh conection (for example)
RABS> reach eth1 by DSL3 or reach eth2 by LDMS and get answered by the same link.
Multipath with load balancing is in my script. If you use it (just try
to adopt to 3 links) your host will be reachable at all adresses.
Adding special rules with firewall mark and dedicated routing tables
for classified traffic will give you what you want.
But later you will have a problem when you go to the traffic shaping
(and I thing sooner or later you will) TC does not accept aliases on
interfaces :(
RABS> May someone give me a hit on what I'm doing wrong or what must I do to get it
RABS> working.
RABS> Best regards
RABS> _______________________________________________
RABS> LARTC mailing list / LARTC@mailman.ds9a.nl
RABS> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
--
Pozdrowienia,
Robert
From Robert Kurjata Wed Jan 14 20:30:48 2004
From: Robert Kurjata (Robert Kurjata)
Date: Wed, 14 Jan 2004 21:30:48 +0100
Subject: [LARTC] wich tools
In-Reply-To: <40059B9E.80602@e-ar.pl>
References: <40059B9E.80602@e-ar.pl>
Message-ID: <1148909502.20040114213048@ire.pw.edu.pl>
Witaj Micha³,
W Twoim liœcie datowanym 14 stycznia 2004 (20:42:22) mo¿na przeczytaæ:
MW> Hello
MW> I have two DSL modems witch are connected to my isp, in future my boss
MW> want to buy another connection via DSL modem. Then i will have 3 DSL
MW> modems. With every DSL modem i get 3x8 IP`s (netmask 248) from my ISP,
MW> now i have question how to configure gateway wich tools should i use.
MW> Because ip route and next hop via. wich i use now makes his work fine
MW> but with new kernels there is an error in syslog "route sent us
MW> somewhere else", and i think that with 3 DSL`s i will have problem
MW> (there can be situation when 1DSL is busy and 2DSL aren`t).
MW> Greetings
MW> Michal Witkowski
I have 3 uplinks, kernel 2.4.22+patch-o-matic+htb+esfq+julian's routes
patch working load balancing and have no problems :)
Classic configuration.
Maybe something with missing patches?
MW> _______________________________________________
MW> LARTC mailing list / LARTC@mailman.ds9a.nl
MW> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
--
Pozdrowienia,
Robert
From stef.coene@docum.org Wed Jan 14 22:00:42 2004
From: stef.coene@docum.org (Stef Coene)
Date: Wed, 14 Jan 2004 23:00:42 +0100
Subject: [LARTC] sum of child rates exceeds parent rate
In-Reply-To:
References:
Message-ID: <200401142300.42294.stef.coene@docum.org>
On Tuesday 13 January 2004 23:58, arek@chelmnet.pl wrote:
> > > Wow wow, wait !
> >
> > Ok :)
> >
> > > you can have 100 child classess in a sum of 100Megs, root class equal
> > > 10Megs.
> > > the sum of all child classes will be 10Megs, and no more (if
> >
> > you ceil root
> >
> > > rate to 10Megs it at htb)
> >
> > Wrong. The configured rate of a class is _always_ satisfied.
> > If you have a
> > 100M link, a parent class ceiled to 10M and 100 classes with
> > rate = 1M, each
> > class will get 1M. So together they will get 100M. And even if
> > that is more
> > the the ceil of the parent.
> > So you can overlimit a parent class.
>
> Well, i must practice that.
> I've always thougght that root/parent queue tell lower queues to start
> dropping packets.
It's the other way around. The class needs a token to send a packet. As long
as the class has tokens, it can send packets. If the class has used all his
tokens, it asks the parent if he has tokens left.
> Sure, you must be right, the queues will be told to drop packets, but they
> will not do it unless they get their typed rate.
Think about a bucket with tokens, not rate:
bucket size = burst
rate of new token entering bucket = rate
1 token = 1 packet
(this is for rate and ceil)
> So if any of my 100 queues have 1Mbit traffic, then lower queues will start
> to drop anything that is above 1Mbit for each queue individually.
Yes.
> So we overlimit 10Mbit celi about 10 times (in special case).
Yes.
Stef
--
stef.coene@docum.org
"Using Linux as bandwidth manager"
http://www.docum.org/
#lartc @ irc.openprojects.net
From andybr@bol.com.br Thu Jan 15 01:11:05 2004
From: andybr@bol.com.br (andybr)
Date: Wed, 14 Jan 2004 23:11:05 -0200
Subject: [LARTC] simple(?!?) source routing
Message-ID:
Hi all,
This is easy. First let ppp0 as your default gateway and
use iproute to create a table call any name you want and
then you put ppp1 default route inside that table. After
that you have to create a rule to put the host you would
like insede it and dont forget to put a rule in the
iptables saying that everything going out via ppp1 SNAT -
-to IP_PPP1_EXTERNAL. ;)
[]=B4s
Anderson
> Hi,
>
> I've set up a Linux box with redhat on to act as an int
ernet gateway and I'm running into a few problems. Its g
ot two adsl modems connected to it, both connected to sep
erate 512kbs lines. Now I've followed the simple source
routing in the advanced routing howto to the letter but i
t doesnt work.
>
> I've got it autoconnecting on startup and redhat puts p
pp1 as the default gateway, this is then setup for masque
rading for the entire network. Therefore I've tried sett
ing up ppp0 as the deafult gateway for only one computer
(10.0.0.11), as it says at http://lartc.org/howto/lartc.r
pdb.html#LARTC.RPDB.SIMPLE I've done everything it says t
here and im 99% sure I've put the right ip addreses in et
c. When Ive gone through it that computer is no longer a
ble to access the net (the rest of the network is unaffec
ted).
>
> I'm pretty sure its the way ppp0 is configured, if I se
t it up so 10.0.0.11 uses ppp1 instead of ppp0 (ip rule a
dd default via xxx.xxx.xxx.xxx dev ppp1 table chris) it w
orks fine but obviously thers no point in that.
>
> Hope all this makes sence to someone, it baerly does ti
me. May thanks in advance.
>
> Chris
__________________________________________________________________________
Acabe com aquelas janelinhas que pulam na sua tela.
AntiPop-up UOL - =C9 gr=E1tis!
http://antipopup.uol.com.br/
From virgil@vipnet.ro Thu Jan 15 07:21:42 2004
From: virgil@vipnet.ro (Cristea Virgil Ionut)
Date: Thu, 15 Jan 2004 09:21:42 +0200
Subject: [LARTC] HTB
Message-ID:
Hi, I have the following questions:
I only have one htb computer (2 nics) to shape the international traffic
as well as the metropolitan traffic (i have a list of metropolitan ip's to
use). Can this be achived using iptables with packet marking (on that htb
computer the 2 nics are bridged)?
If it can will there be delays introduced by the shaping operation (the
metropolitan link is a 100M fiber - full almost all the time)???
From Robert Kurjata Thu Jan 15 08:27:42 2004
From: Robert Kurjata (Robert Kurjata)
Date: Thu, 15 Jan 2004 09:27:42 +0100
Subject: Re[2]: [LARTC] wich tools
In-Reply-To: <073101c3db3e$d323cd20$c2bf09ca@huecal>
References: <40059B9E.80602@e-ar.pl> <1148909502.20040114213048@ire.pw.edu.pl>
<073101c3db3e$d323cd20$c2bf09ca@huecal>
Message-ID: <772939256.20040115092742@ire.pw.edu.pl>
Witaj hare,
W Twoim liœcie datowanym 15 stycznia 2004 (09:08:56) mo¿na przeczytaæ:
hr> Hi Robert
hr> iam trying setup like yours
hr> for my DNS Services
hr> i have patched all what u did
hr> can i share your script for the load balance
hr> or failover links script
script is in the archives
http://mailman.ds9a.nl/pipermail/lartc/2003q4/010372.html
and its free for all :) as the source for the idea -
nano-howto :)
hr> to get an indea how can i create them for my server
hr> thanks
hr> hare
hr> ----- Original Message -----
hr> From: "Robert Kurjata"
hr> To: "Micha³ Witkowski"
hr> Cc:
hr> Sent: Thursday, January 15, 2004 2:00 AM
hr> Subject: Re: [LARTC] wich tools
>> Witaj Micha³,
>>
>> W Twoim liœcie datowanym 14 stycznia 2004 (20:42:22) mo¿na przeczytaæ:
>>
>> MW> Hello
>> MW> I have two DSL modems witch are connected to my isp, in future my boss
>> MW> want to buy another connection via DSL modem. Then i will have 3 DSL
>> MW> modems. With every DSL modem i get 3x8 IP`s (netmask 248) from my ISP,
>> MW> now i have question how to configure gateway wich tools should i use.
>> MW> Because ip route and next hop via. wich i use now makes his work fine
>> MW> but with new kernels there is an error in syslog "route sent us
>> MW> somewhere else", and i think that with 3 DSL`s i will have problem
>> MW> (there can be situation when 1DSL is busy and 2DSL aren`t).
>> MW> Greetings
>> MW> Michal Witkowski
>>
>> I have 3 uplinks, kernel 2.4.22+patch-o-matic+htb+esfq+julian's routes
>> patch working load balancing and have no problems :)
>>
>> Classic configuration.
>>
>> Maybe something with missing patches?
>>
>> MW> _______________________________________________
>> MW> LARTC mailing list / LARTC@mailman.ds9a.nl
>> MW> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>>
>> --
>> Pozdrowienia,
>> Robert
>>
>> _______________________________________________
>> LARTC mailing list / LARTC@mailman.ds9a.nl
>> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>>
--
Pozdrowienia,
Robert mailto:rkurjata@ire.pw.edu.pl
From cbolton@hirstanddanson.co.uk Thu Jan 15 08:37:33 2004
From: cbolton@hirstanddanson.co.uk (Chris Bolton)
Date: Thu, 15 Jan 2004 08:37:33 -0000
Subject: Fw: Re:[LARTC] simple(?!?) source routing
Message-ID: <006c01c3db42$d2627c20$0b00000a@Server2.hd>
Hi,
Thanks for the reply. Thats where the problem starts. If I set ppp0 as
the
default gw the internet doesnt work anymore. This is how im doing it...
route del default
route add default gw 217.32.81.74 dev ppp0
if I put it back to ppp1...
route del default
route add default gw 217.32.68.73 dev ppp1
It works fine again. Whats up with that?
Cheers,
Chris
----- Original Message -----
From: "andybr"