Re: [LARTC] Fair que between 255 users
Jens Thiele wrote: > ESFQ might help. Using google: > http://fatooh.org/esfq-2.6/ > > Note: > Corey Hickey is working on getting some ESFQ features into kernel > mainline SFQ: > Search for "SFQ: backport some features from ESFQ (try 5)" on netdev ml. Yep. :) Unfortunately, the only missing feature from those patches is the alternate hash types, which I will end up handling later, one way or another. My most recent ESFQ (tarball + incremental patch) still applies to 2.6.23.1 and builds fine. I haven't actually tested it, but I expect it won't have any problems. That will suffice for now. -Corey ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
[Fwd: Re: [LARTC] custom route for forwarded traffic]
Aleksander Kamenik wrote: Hi, If I add a rule to the main routing table in the users network's firewall for servers network's external IP to go through the VPN, I will break the VPN connection (kind of like the chicken and egg problem). This true only for cases like L3 IPSec where traffic to be encrypted is based on src/dst IP combo. If you had a VPN virtual interface, this should not be a problem. You can choose to route traffic of your choice. Good examples is OpenVPN and L2 IPSec. Mohan ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Re: [LARTC] Fair que between 255 users
WRR worked for me in the past but it is not maintained anymore. On 10/30/07, Jens Thiele <[EMAIL PROTECTED]> wrote: > On 29 Okt 2007, [EMAIL PROTECTED] wrote: > > > В сообщении от Monday 29 October 2007 22:46:39 Thomas Elsgaard > > написал(а): > >> Hello guys > >> > >> I have a subnet with 255 users, which need to share 1 single slow > >> internet connection, so i would like to implement a kind of *fair > >> queuing *on the UPLOAD between them, which means that they all share > >> the connection equally.. > >> > >> The tools that i have available is: A linux box with IPROUTE2,HTB and > >> TC.. > >> > >> I have looked at some examples, and my first idea was to make 255 > >> entries in iproute2, marking each source IP from 1-255 , and then > >> adding one class in HTB, with 255 childs... but isn't there a smarter > >> way? > >> > >> Does anyone have an example? or a good idea > > > > > > simply sfq -- is enough, isn't it? > > No (at least not yet?) > > Quoting the man page (man sfq): > "SFQ does not shape traffic but only schedules the transmission of > packets, based on 'flows'. The goal is to ensure fairness so that each > flow is able to send data in turn, thus preventing any single flow from > drowning out the rest." > > And: > "SFQ is work-conserving and therefore always delivers a packet if it > has one available." > > ESFQ might help. Using google: > http://fatooh.org/esfq-2.6/ > > Note: > Corey Hickey is working on getting some ESFQ features into kernel > mainline SFQ: > Search for "SFQ: backport some features from ESFQ (try 5)" on netdev ml. > > Greetings > Jens > > ___ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > -- Marco Casaroli SapucaiNet Telecom +55 35 34712377 ext. 5 ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Re: [LARTC] Fair que between 255 users
On 29 Okt 2007, [EMAIL PROTECTED] wrote: > В сообщении от Monday 29 October 2007 22:46:39 Thomas Elsgaard > написал(а): >> Hello guys >> >> I have a subnet with 255 users, which need to share 1 single slow >> internet connection, so i would like to implement a kind of *fair >> queuing *on the UPLOAD between them, which means that they all share >> the connection equally.. >> >> The tools that i have available is: A linux box with IPROUTE2,HTB and >> TC.. >> >> I have looked at some examples, and my first idea was to make 255 >> entries in iproute2, marking each source IP from 1-255 , and then >> adding one class in HTB, with 255 childs... but isn't there a smarter >> way? >> >> Does anyone have an example? or a good idea > > > simply sfq -- is enough, isn't it? No (at least not yet?) Quoting the man page (man sfq): "SFQ does not shape traffic but only schedules the transmission of packets, based on ’flows’. The goal is to ensure fairness so that each flow is able to send data in turn, thus preventing any single flow from drowning out the rest." And: "SFQ is work-conserving and therefore always delivers a packet if it has one available." ESFQ might help. Using google: http://fatooh.org/esfq-2.6/ Note: Corey Hickey is working on getting some ESFQ features into kernel mainline SFQ: Search for "SFQ: backport some features from ESFQ (try 5)" on netdev ml. Greetings Jens ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Re: [LARTC] custom route for forwarded traffic
On 10/30/07 09:38, Aleksander Kamenik wrote: I have two networks, users and servers connected via vpn (ipsec). Both internal networks. The routing is fine and connections work both ways. Accordingly both networks have a firewall each which faces the internet and they create the vpn link between each other. Both firewalls have only one external IP (if they had more, I wouldn't be asking). The servers network's firewall however does DNAT too. This is for external clients who connect to the external IP of the firewall and so can connect to the internal mail and webserver. I want the computers in the users network to connect to the external IP of the servers firewall AND have the connection go through the VPN. If I add a rule to the main routing table in the users network's firewall for servers network's external IP to go through the VPN, I will break the VPN connection (kind of like the chicken and egg problem). So I need to create a route, which will apply only for forwarded connections. How do I do that? It has been a long time sense I messed with IPSec under Linux so I can not say any thing for sure. But what I can say is the direction that I would start looking. +--++--+ (LAN 1)---+ Router 1 +---(INet)---+ Router 2 +---(LAN 2) +--++--+ I would only encrypt traffic that is from / to LAN 1 and to / from LAN 2 through the IPSec VPN. Any other traffic from / to LAN 1 that is not going to / from LAN 2 would be unencrypted and vice versa for LAN 2. This way when LAN 1 tried to access the external IP of Router 2 it would not match your routing rules for encryption and thus not be encrypted. If the traffic is not encrypted it should be subject to the normal DNAT rule(s) on Route 2. Likewise for reverse traffic and the corresponding traffic from LAN 2. I'm not sure how to set up such routes with current IPSec implementations so I can't help specifically with that. What I do see is the various types of traffic that will be seen from each end. LAN 1 <-> LAN 2(encrypted via IPSec VPN) (LAN 1 subnet to LAN 2 subnet) LAN 1 <-> INet (unencrypted) (Router 1 external to INet) LAN 1 <-> Router 2 (unencrypted) (Router 1 external to Router 2 external) INet <-> Router 1 (unencrypted) (INet to Router 1 external & DNATed in) The same above is true in reverse for LAN 2. So in short, I see four classes of traffic at each connection. I hope this helps clear things up and make the water a little less muddy. If you need any thing else, I'll be glad to try. Grant. . . . ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
[LARTC] custom route for forwarded traffic
Hi, I have two networks, users and servers connected via vpn (ipsec). Both internal networks. The routing is fine and connections work both ways. Accordingly both networks have a firewall each which faces the internet and they create the vpn link between each other. Both firewalls have only one external IP (if they had more, I wouldn't be asking). The servers network's firewall however does DNAT too. This is for external clients who connect to the external IP of the firewall and so can connect to the internal mail and webserver. I want the computers in the users network to connect to the external IP of the servers firewall AND have the connection go through the VPN. If I add a rule to the main routing table in the users network's firewall for servers network's external IP to go through the VPN, I will break the VPN connection (kind of like the chicken and egg problem). So I need to create a route, which will apply only for forwarded connections. How do I do that? Thanks, -- Aleksander Kamenik system administrator +372 6659 649 [EMAIL PROTECTED] Krediidiinfo AS http://www.krediidiinfo.ee/ ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Re: [LARTC] Fair que between 255 users
On Tuesday 30 October 2007 22:18, Aleksander Kamenik wrote: > Peter V. Saveliev wrote: > > simply sfq -- is enough, isn't it? > > sfq is great actually, but it works for connections. If you have say 10 > users and 9 of them each have 1 active ftp RETR connections but the 10th > user has 100 active ftp RETR connections, then he gets 99,9% of traffic, > doesn't he? (just an example) you can try esfq. Daniel PadiNet Makassar ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Re: [LARTC] Fair que between 255 users
Peter V. Saveliev wrote: simply sfq -- is enough, isn't it? sfq is great actually, but it works for connections. If you have say 10 users and 9 of them each have 1 active ftp RETR connections but the 10th user has 100 active ftp RETR connections, then he gets 99,9% of traffic, doesn't he? (just an example) I think what the GP is looking for, as am I, is a simple way of giving each user an equal share of the bandwidth. This can be achieved for example by hundreds of HTB classes. But that's the rub. I have 20 /24 internal networks which amounts to a maximum of 5000+ unique IP's which DHCP gives out. There are only about 500 active users though and the total number of users (active at least once a month) is probably around 1000. I don't think it makes sense to create 5000 htb leaf classes and let them all borrow from each other. 90% of them would be _only_ lending and 10% would be fighting over who gets the small bit of it. What I'm looking for is something like the ISP's use. Like sfq which creates fair queues per connections pools where each pool is a bunch of connections from/to the same IP addr. Is there something like this for linux? -- Aleksander Kamenik system administrator +372 6659 649 [EMAIL PROTECTED] Krediidiinfo AS http://www.krediidiinfo.ee/ ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Re: [LARTC] Some questions about HTB
BERTRAND Joël wrote: Hello, I think I have found my mistake... ... # eth0 tc qdisc add dev $PUBLIC_INTERFACE root handle 2: htb default 200 tc class add dev $PUBLIC_INTERFACE parent 2: classid 2:1 \ htb rate $MAX_PUBLIC_RATE burst 20k tc class add dev $PUBLIC_INTERFACE parent 2: classid 2:200 \ htb rate 16kbit tc qdisc add dev $PUBLIC_INTERFACE parent 2:200 sfq perturb 10 # 213.215.42.71 tc class add dev $PUBLIC_INTERFACE parent 2:1 classid 2:71 \ htb rate 1024kbps ceil 1024kbps burst 20k tc qdisc add dev $PUBLIC_INTERFACE parent 2:71 handle 71: sfq perturb 10 tc filter add dev $PUBLIC_INTERFACE protocol ip parent 2:71 \ should be tc filter add dev $PUBLIC_INTERFACE protocol ip parent 2: prio 1 handle 71 fw flowid 2:71 # 213.215.42.72 tc class add dev $PUBLIC_INTERFACE parent 2:1 classid 2:72 \ htb rate 512kbit tc qdisc add dev $PUBLIC_INTERFACE parent 2:72 handle 72: sfq perturb 10 tc filter add dev $PUBLIC_INTERFACE protocol ip parent 2:72 \ prio 1 handle 72 fw flowid 2:72 When I start for example a ftp connection (and only one) on 213.215.42.71, traffic shaping works fine (fw mark are set by iptables rules). When more than one connection are done, paquet transfert is very slow (~20 kbps even I specify 1024kbps). I suspect a mistake in my code but I don't know how fix it. I have tried to use quantum, r2q, burst, cburst without any success. Any idea ? Regards, JKB ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
[LARTC] 2 NICS - local services not shaping correctly
Hi Having a problem trying to figure out how to shape local services running on the debian box (asterisk, squid etc) as currently the voice only seems to be getting shaped one way when making external calls. For example I have the rules below (these are the matching rules only not the actual policy rules): #Create Chain for local traffic (outbound) /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j MARK --set-mark 0x4445 /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j RETURN /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66 -j MARK --set-mark 0x4445 /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66 -j RETURN #Create Chain for all remaining traffic (outbound) /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -j MARK --set-mark 0x4446 /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth0 -j RETURN #Phones match (outbound) /sbin/iptables -t mangle -A match-chain-eth1-1:11 -p tcp -m multiport --port 4569 -j CLASSIFY --set-class 1:1006 /sbin/iptables -t mangle -A match-chain-eth1-1:11 -p tcp -m multiport --port 4569 -j RETURN /sbin/iptables -t mangle -A match-chain-eth1-1:11 -p udp -m multiport --port 4569 -j CLASSIFY --set-class 1:1006 /sbin/iptables -t mangle -A match-chain-eth1-1:11 -p udp -m multiport --port 4569 -j RETURN #Create Chain for local traffic (inbound) /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j MARK --set-mark 0x4447 /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s 193.xxx.xxx.66 -d 193.xxx.xxx.69 -j RETURN /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66 -j MARK --set-mark 0x4447 /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -s 193.xxx.xxx.69 -d 193.xxx.xxx.66 -j RETURN #Create Chain for all remaining traffic (inbound) /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -j MARK --set-mark 0x4448 /sbin/iptables -t mangle -A match-all -m physdev --physdev-in eth1 -j RETURN #Phones match (inbound) /sbin/iptables -t mangle -A match-chain-eth0-1:12 -p tcp -m multiport --port 4569 -j CLASSIFY --set-class 1:2008 /sbin/iptables -t mangle -A match-chain-eth0-1:12 -p tcp -m multiport --port 4569 -j RETURN /sbin/iptables -t mangle -A match-chain-eth0-1:12 -p udp -m multiport --port 4569 -j CLASSIFY --set-class 1:2008 /sbin/iptables -t mangle -A match-chain-eth0-1:12 -p udp -m multiport --port 4569 -j RETURN Kind Regards William Bohannan ___ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
