<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Actually i gave up, i tried and tried and tried so
many times, upgrading software falling back to an old version </FONT></DIV>
<DIV><FONT face=Arial size=2>but it didn't work, that's it.</FONT></DIV>
<DIV><FONT face=Arial size=2>i can't do work together tc with iptables and
iproute2</FONT></DIV>
<DIV><FONT face=Arial size=2>when i mark a packet with iptables tc doesn't
recognize them so it falls at the default leaf of the tc's tree</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>what i like is to mark packets depending on their
ip (the one who make a connetion into de linux (gateway) box) and
port.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>i'll transcript my script because i really don't
know what to do.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>p.d. so, what i like to do is just simple, i guess;
everything comes from eth1 and goes to eth1 (lan users to linux box
services) must be shapped by ipaddres + port (dport i guess INPUT/OUTPUT
CHAIN?)</FONT></DIV>
<DIV><FONT face=Arial size=2>and everything comes from ETH1 goes to ETH0
(Internet Access i guess PREROUTING/POSTROUTING/FORWARD chain) MUST BE SHAPPED
BY PORT + IPADDRESS</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>i have this situation on the linux
server:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>eth0: (Out to internet)</FONT></DIV>
<DIV><FONT face=Arial size=2>eth1: (LAN)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>configutarion: eth0 (network 200.123.166.72,
broadcast: 200.123.166.79; (ip range: 200.123.166.73-77)</FONT></DIV>
<DIV><FONT face=Arial size=2>eth0 ip: 200.123.166.73</FONT></DIV>
<DIV><FONT face=Arial size=2>eth0: gw: 200.123.166.78</FONT></DIV>
<DIV><FONT face=Arial size=2>eth0: netmask: 255.255.255.248</FONT></DIV>
<DIV><FONT face=Arial size=2>eth dns1: 200.123.166.73</FONT></DIV>
<DIV><FONT face=Arial size=2>eth0 dns2: 200.123.166.74</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>configuration: eth1 (network 172.16.0.0 broadcast:
172.16.0.255 (ip range: 172.16.0.1-254)</FONT></DIV>
<DIV><FONT face=Arial size=2>eth1 ip: 172.16.0.1</FONT></DIV>
<DIV><FONT face=Arial size=2>eth1: gw: (none)</FONT></DIV>
<DIV><FONT face=Arial size=2>eth1: netmask: 255.255.0.0</FONT></DIV>
<DIV><FONT face=Arial size=2>eth1: dns1: 200.123.166.73</FONT></DIV>
<DIV>
<DIV><FONT face=Arial size=2>eth1: dns2: 200.123.166.74</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>LINUX BOX SERVING THIS SERVICES: HTTP (PORT 80)
SMTP (PORT 25) POP3 (PORT 110) SSH (PORT 22) FTP (PORT 20-21) SMB FS (PORT
136-139) IRC (PORT 6667)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>CONFIGURATION OF TC:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2><FONT
size=3>tc=/sbin/tc<BR>iptables=/sbin/iptables</FONT></FONT></DIV><FONT
face=Arial size=2><FONT size=3></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3></FONT></FONT> </DIV>
<DIV><FONT face=Arial size=2><FONT size=3>echo "Building tc
Classes"<BR>IFACE="eth0 eth1"<BR></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>for i in
$IFACE;do<BR></FONT></FONT><FONT face=Arial size=2><FONT size=3>$tc qdisc add
dev $i root handle 1: htb default 10<BR><BR>$tc class add dev $i parent 1:
classid 1:1 htb rate 2048mbit <BR><BR>$tc class add dev $i parent 1:1 classid
1:10 htb rate 10kbit ceil 128kbit quantum 1514<BR>$tc class add dev $i parent
1:1 classid 1:20 htb rate 10kbit ceil 256kbit quantum 1514 <BR>$tc class
add dev $i parent 1:1 classid 1:30 htb rate 10kbit ceil 512kbit quantum
1514 <BR>$tc class add dev $i parent 1:1 classid 1:40 htb rate 10kbit ceil
1024bit quantum 1514 <BR>$tc class add dev $i parent 1:1 classid 1:50 htb
rate 10kbit ceil 2048bit quantum 1514 <BR></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>$tc class add dev $i parent 1:1
classid 1:60 htb rate 10kbit ceil 256kbit quantum 1514 # USED FOR
HTTP/IRC</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>$tc class add dev $i parent 1:1
classid 1:70 htb rate 10kbit ceil 128kbit quantum 1514 # USED FOR EMAIL
(SMTP/POP3)<BR><BR><BR>$tc qdisc add dev $i parent 1:10 handle 10: sfq perturb
10<BR>$tc qdisc add dev $i parent 1:20 handle 20: sfq perturb 10<BR>$tc qdisc
add dev $i parent 1:30 handle 30: sfq perturb 10<BR>$tc qdisc add dev $i parent
1:40 handle 40: sfq perturb 10<BR>$tc qdisc add dev $i parent 1:50 handle 50:
sfq perturb 10<BR></FONT></FONT><FONT face=Arial size=2><FONT
size=3></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>$tc qdisc add dev $i parent 1:60
handle 60: sfq perturb 10<BR>$tc qdisc add dev $i parent 1:70 handle 70: sfq
perturb 10<BR></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 10 fw flowid 1:10</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 20 fw flowid 1:20</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 30 fw flowid 1:30</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 40 fw flowid 1:40</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 50 fw flowid 1:50</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 60 fw flowid 1:60</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3>
<DIV><FONT face=Arial size=2><FONT size=3>$tc filter add dev $i parent 1:0
protocol ip prio 0 handle 70 fw flowid 1:70</FONT></FONT></DIV>
<DIV><FONT face=Arial size=2><FONT size=3><FONT
size=2></FONT> </DIV></FONT></FONT></DIV></FONT></FONT></DIV></FONT></FONT></DIV></FONT></FONT></DIV></FONT></FONT></DIV></FONT></FONT></DIV></FONT></FONT>
<DIV><FONT face=Arial size=2><FONT size=3><FONT
size=2></FONT></FONT></FONT> </DIV>
<DIV><FONT face=Arial size=2><FONT size=3><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>PORTS="80 6667 20 21"</FONT></DIV>
<DIV><FONT size=2>#ANY IP MUST BE SHAPPED BY THESE PORTS TO THE 1:60
LEAF</FONT></DIV>
<DIV><FONT size=2>for i in $PORTS;do</FONT></DIV>
<DIV><FONT size=2> $iptables -t mangle -A INPUT -i
eth1 -s 172.16.0.0/16 -p tcp --dport $i -j MARK --set-mark
60</FONT></DIV>
<DIV>
<DIV><FONT size=2> $iptables -t mangle -A INPUT -i
eth1 -s 172.16.0.0/16 -p udp --dport $i -j MARK --set-mark
60</FONT></DIV></DIV>
<DIV><FONT size=2>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2> $iptables -t mangle -A OUTPUT -o
eth1 -d 172.16.0.0/16 -p tcp --dport $i -j MARK --set-mark
60</FONT></DIV>
<DIV>
<DIV><FONT size=2> $iptables -t mangle -A OUTPUT -o
eth1 -d 172.16.0.0/16 -p udp --dport $i -j MARK --set-mark
60</FONT></DIV></DIV></FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV>
<DIV><FONT size=2> $iptables -t mangle -A INPUT -i
eth0 -d 200.123.166.72/30 -p tcp --dport $i -j MARK --set-mark
60</FONT></DIV>
<DIV>
<DIV><FONT size=2> $iptables -t mangle -A INPUT -i
eth0 -d 200.123.166.72/30 -p udp --dport $i -j MARK --set-mark
60</FONT></DIV></DIV>
<DIV><FONT size=2>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2> $iptables -t mangle -A OUTPUT -o
eth0 -d 200.123.166.72/30 -p tcp --dport $i -j MARK --set-mark
60</FONT></DIV>
<DIV>
<DIV><FONT size=2> $iptables -t mangle -A OUTPUT -o
eth0 -d 200.123.166.72/30 -p udp --dport $i -j MARK --set-mark
60</FONT></DIV></DIV></FONT></DIV></FONT><FONT size=2></FONT></DIV>
<DIV><FONT size=2>done</FONT></DIV>
<DIV> </DIV>
<DIV>SOOOOOOOOOOOOOOOOOO WHAT AM I DOING WRONG, COUSE EVERY TRAFFIC COMMING OR
GOING JUST FALLS ON 1:10 (DEFAULT LEAF)</DIV>
<DIV> </DIV>
<DIV>This is an extract from the script, so it show you the LOCAL PROCESS of
information not PREROUTING</DIV>
<DIV> </DIV>
<DIV>PLEASE HELPPPPPPPPP ME I DON'T KNOW WHAT TO DO AND MY SYSTEM IS GOING DOWN
FASTER.-</DIV>
<DIV> </DIV>
<DIV>MY CONFIGURATION IS:</DIV>
<DIV>ip utility, iproute2-ss050330</DIV>
<DIV>tc utility, iproute2-ss050330<BR>iptables v1.3.3</DIV>
<DIV>kernel: 2.6.13</DIV>
<DIV>patch applied for kernel and iproute and iptables (esfq + wrr)</DIV>
<DIV>heeeeeeeeeeeeeeeelp</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>thank you so much </DIV>
<DIV>Guillermo from Argentina</DIV>
<DIV><BR><BR> </DIV></FONT></BODY></HTML>